pulumi-vault 7.1.0__py3-none-any.whl → 7.2.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +19 -1
- pulumi_vault/_inputs.py +873 -673
- pulumi_vault/ad/__init__.py +1 -1
- pulumi_vault/ad/get_access_credentials.py +27 -28
- pulumi_vault/ad/secret_backend.py +579 -580
- pulumi_vault/ad/secret_library.py +120 -121
- pulumi_vault/ad/secret_role.py +104 -105
- pulumi_vault/alicloud/__init__.py +1 -1
- pulumi_vault/alicloud/auth_backend_role.py +222 -223
- pulumi_vault/approle/__init__.py +1 -1
- pulumi_vault/approle/auth_backend_login.py +138 -139
- pulumi_vault/approle/auth_backend_role.py +292 -293
- pulumi_vault/approle/auth_backend_role_secret_id.py +202 -203
- pulumi_vault/approle/get_auth_backend_role_id.py +23 -24
- pulumi_vault/audit.py +103 -104
- pulumi_vault/audit_request_header.py +52 -53
- pulumi_vault/auth_backend.py +132 -133
- pulumi_vault/aws/__init__.py +1 -1
- pulumi_vault/aws/auth_backend_cert.py +86 -87
- pulumi_vault/aws/auth_backend_client.py +307 -308
- pulumi_vault/aws/auth_backend_config_identity.py +103 -104
- pulumi_vault/aws/auth_backend_identity_whitelist.py +69 -70
- pulumi_vault/aws/auth_backend_login.py +258 -259
- pulumi_vault/aws/auth_backend_role.py +486 -487
- pulumi_vault/aws/auth_backend_role_tag.py +155 -156
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +69 -70
- pulumi_vault/aws/auth_backend_sts_role.py +86 -87
- pulumi_vault/aws/get_access_credentials.py +59 -60
- pulumi_vault/aws/get_static_access_credentials.py +19 -20
- pulumi_vault/aws/secret_backend.py +1016 -439
- pulumi_vault/aws/secret_backend_role.py +256 -257
- pulumi_vault/aws/secret_backend_static_role.py +137 -138
- pulumi_vault/azure/__init__.py +1 -1
- pulumi_vault/azure/_inputs.py +26 -27
- pulumi_vault/azure/auth_backend_config.py +222 -223
- pulumi_vault/azure/auth_backend_role.py +307 -308
- pulumi_vault/azure/backend.py +1057 -285
- pulumi_vault/azure/backend_role.py +194 -195
- pulumi_vault/azure/get_access_credentials.py +75 -76
- pulumi_vault/azure/outputs.py +16 -17
- pulumi_vault/cert_auth_backend_role.py +443 -444
- pulumi_vault/config/__init__.py +1 -1
- pulumi_vault/config/__init__.pyi +1 -2
- pulumi_vault/config/_inputs.py +13 -14
- pulumi_vault/config/outputs.py +380 -381
- pulumi_vault/config/ui_custom_message.py +140 -141
- pulumi_vault/config/vars.py +31 -32
- pulumi_vault/consul/__init__.py +1 -1
- pulumi_vault/consul/secret_backend.py +887 -256
- pulumi_vault/consul/secret_backend_role.py +222 -223
- pulumi_vault/database/__init__.py +1 -1
- pulumi_vault/database/_inputs.py +3167 -3168
- pulumi_vault/database/outputs.py +2123 -2124
- pulumi_vault/database/secret_backend_connection.py +259 -260
- pulumi_vault/database/secret_backend_role.py +205 -206
- pulumi_vault/database/secret_backend_static_role.py +218 -219
- pulumi_vault/database/secrets_mount.py +426 -380
- pulumi_vault/egp_policy.py +86 -87
- pulumi_vault/gcp/__init__.py +1 -1
- pulumi_vault/gcp/_inputs.py +98 -99
- pulumi_vault/gcp/auth_backend.py +322 -323
- pulumi_vault/gcp/auth_backend_role.py +347 -348
- pulumi_vault/gcp/get_auth_backend_role.py +91 -92
- pulumi_vault/gcp/outputs.py +66 -67
- pulumi_vault/gcp/secret_backend.py +878 -336
- pulumi_vault/gcp/secret_impersonated_account.py +112 -113
- pulumi_vault/gcp/secret_roleset.py +115 -116
- pulumi_vault/gcp/secret_static_account.py +115 -116
- pulumi_vault/generic/__init__.py +1 -1
- pulumi_vault/generic/endpoint.py +138 -139
- pulumi_vault/generic/get_secret.py +39 -40
- pulumi_vault/generic/secret.py +95 -96
- pulumi_vault/get_auth_backend.py +29 -30
- pulumi_vault/get_auth_backends.py +19 -20
- pulumi_vault/get_namespace.py +21 -22
- pulumi_vault/get_namespaces.py +19 -20
- pulumi_vault/get_nomad_access_token.py +25 -26
- pulumi_vault/get_policy_document.py +10 -11
- pulumi_vault/get_raft_autopilot_state.py +31 -32
- pulumi_vault/github/__init__.py +1 -1
- pulumi_vault/github/_inputs.py +50 -51
- pulumi_vault/github/auth_backend.py +285 -286
- pulumi_vault/github/outputs.py +34 -35
- pulumi_vault/github/team.py +69 -70
- pulumi_vault/github/user.py +69 -70
- pulumi_vault/identity/__init__.py +1 -1
- pulumi_vault/identity/entity.py +103 -104
- pulumi_vault/identity/entity_alias.py +86 -87
- pulumi_vault/identity/entity_policies.py +78 -79
- pulumi_vault/identity/get_entity.py +62 -63
- pulumi_vault/identity/get_group.py +75 -76
- pulumi_vault/identity/get_oidc_client_creds.py +19 -20
- pulumi_vault/identity/get_oidc_openid_config.py +39 -40
- pulumi_vault/identity/get_oidc_public_keys.py +17 -18
- pulumi_vault/identity/group.py +171 -172
- pulumi_vault/identity/group_alias.py +69 -70
- pulumi_vault/identity/group_member_entity_ids.py +69 -70
- pulumi_vault/identity/group_member_group_ids.py +69 -70
- pulumi_vault/identity/group_policies.py +78 -79
- pulumi_vault/identity/mfa_duo.py +183 -184
- pulumi_vault/identity/mfa_login_enforcement.py +147 -148
- pulumi_vault/identity/mfa_okta.py +166 -167
- pulumi_vault/identity/mfa_pingid.py +160 -161
- pulumi_vault/identity/mfa_totp.py +217 -218
- pulumi_vault/identity/oidc.py +35 -36
- pulumi_vault/identity/oidc_assignment.py +69 -70
- pulumi_vault/identity/oidc_client.py +155 -156
- pulumi_vault/identity/oidc_key.py +103 -104
- pulumi_vault/identity/oidc_key_allowed_client_id.py +52 -53
- pulumi_vault/identity/oidc_provider.py +112 -113
- pulumi_vault/identity/oidc_role.py +103 -104
- pulumi_vault/identity/oidc_scope.py +69 -70
- pulumi_vault/identity/outputs.py +42 -43
- pulumi_vault/jwt/__init__.py +1 -1
- pulumi_vault/jwt/_inputs.py +50 -51
- pulumi_vault/jwt/auth_backend.py +400 -354
- pulumi_vault/jwt/auth_backend_role.py +494 -495
- pulumi_vault/jwt/outputs.py +34 -35
- pulumi_vault/kmip/__init__.py +1 -1
- pulumi_vault/kmip/secret_backend.py +1006 -227
- pulumi_vault/kmip/secret_role.py +358 -359
- pulumi_vault/kmip/secret_scope.py +69 -70
- pulumi_vault/kubernetes/__init__.py +1 -1
- pulumi_vault/kubernetes/auth_backend_config.py +171 -172
- pulumi_vault/kubernetes/auth_backend_role.py +273 -274
- pulumi_vault/kubernetes/get_auth_backend_config.py +57 -58
- pulumi_vault/kubernetes/get_auth_backend_role.py +87 -88
- pulumi_vault/kubernetes/get_service_account_token.py +51 -52
- pulumi_vault/kubernetes/secret_backend.py +431 -385
- pulumi_vault/kubernetes/secret_backend_role.py +239 -240
- pulumi_vault/kv/__init__.py +1 -1
- pulumi_vault/kv/_inputs.py +25 -26
- pulumi_vault/kv/get_secret.py +25 -26
- pulumi_vault/kv/get_secret_subkeys_v2.py +39 -40
- pulumi_vault/kv/get_secret_v2.py +41 -42
- pulumi_vault/kv/get_secrets_list.py +17 -18
- pulumi_vault/kv/get_secrets_list_v2.py +25 -26
- pulumi_vault/kv/outputs.py +17 -18
- pulumi_vault/kv/secret.py +61 -62
- pulumi_vault/kv/secret_backend_v2.py +86 -87
- pulumi_vault/kv/secret_v2.py +184 -185
- pulumi_vault/ldap/__init__.py +1 -1
- pulumi_vault/ldap/auth_backend.py +716 -717
- pulumi_vault/ldap/auth_backend_group.py +69 -70
- pulumi_vault/ldap/auth_backend_user.py +86 -87
- pulumi_vault/ldap/get_dynamic_credentials.py +27 -28
- pulumi_vault/ldap/get_static_credentials.py +29 -30
- pulumi_vault/ldap/secret_backend.py +732 -693
- pulumi_vault/ldap/secret_backend_dynamic_role.py +154 -155
- pulumi_vault/ldap/secret_backend_library_set.py +120 -121
- pulumi_vault/ldap/secret_backend_static_role.py +120 -121
- pulumi_vault/managed/__init__.py +1 -1
- pulumi_vault/managed/_inputs.py +274 -275
- pulumi_vault/managed/keys.py +27 -28
- pulumi_vault/managed/outputs.py +184 -185
- pulumi_vault/mfa_duo.py +137 -138
- pulumi_vault/mfa_okta.py +137 -138
- pulumi_vault/mfa_pingid.py +149 -150
- pulumi_vault/mfa_totp.py +154 -155
- pulumi_vault/mongodbatlas/__init__.py +1 -1
- pulumi_vault/mongodbatlas/secret_backend.py +78 -79
- pulumi_vault/mongodbatlas/secret_role.py +188 -189
- pulumi_vault/mount.py +380 -334
- pulumi_vault/namespace.py +78 -79
- pulumi_vault/nomad_secret_backend.py +909 -271
- pulumi_vault/nomad_secret_role.py +103 -104
- pulumi_vault/oci_auth_backend.py +683 -0
- pulumi_vault/oci_auth_backend_role.py +798 -0
- pulumi_vault/okta/__init__.py +1 -1
- pulumi_vault/okta/_inputs.py +31 -32
- pulumi_vault/okta/auth_backend.py +305 -306
- pulumi_vault/okta/auth_backend_group.py +69 -70
- pulumi_vault/okta/auth_backend_user.py +86 -87
- pulumi_vault/okta/outputs.py +21 -22
- pulumi_vault/outputs.py +234 -82
- pulumi_vault/pkisecret/__init__.py +1 -1
- pulumi_vault/pkisecret/_inputs.py +55 -56
- pulumi_vault/pkisecret/backend_acme_eab.py +116 -117
- pulumi_vault/pkisecret/backend_config_acme.py +175 -176
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +394 -395
- pulumi_vault/pkisecret/backend_config_cluster.py +71 -72
- pulumi_vault/pkisecret/backend_config_cmpv2.py +132 -133
- pulumi_vault/pkisecret/backend_config_est.py +149 -150
- pulumi_vault/pkisecret/backend_config_scep.py +205 -159
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +37 -38
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +32 -33
- pulumi_vault/pkisecret/get_backend_config_est.py +30 -31
- pulumi_vault/pkisecret/get_backend_config_scep.py +50 -31
- pulumi_vault/pkisecret/get_backend_issuer.py +63 -64
- pulumi_vault/pkisecret/get_backend_issuers.py +23 -24
- pulumi_vault/pkisecret/get_backend_key.py +29 -30
- pulumi_vault/pkisecret/get_backend_keys.py +23 -24
- pulumi_vault/pkisecret/outputs.py +61 -62
- pulumi_vault/pkisecret/secret_backend_cert.py +415 -416
- pulumi_vault/pkisecret/secret_backend_config_ca.py +54 -55
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +75 -76
- pulumi_vault/pkisecret/secret_backend_config_urls.py +105 -106
- pulumi_vault/pkisecret/secret_backend_crl_config.py +241 -242
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +515 -516
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +78 -79
- pulumi_vault/pkisecret/secret_backend_issuer.py +286 -287
- pulumi_vault/pkisecret/secret_backend_key.py +146 -147
- pulumi_vault/pkisecret/secret_backend_role.py +873 -874
- pulumi_vault/pkisecret/secret_backend_root_cert.py +677 -678
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +660 -661
- pulumi_vault/pkisecret/secret_backend_sign.py +346 -347
- pulumi_vault/plugin.py +154 -155
- pulumi_vault/plugin_pinned_version.py +52 -53
- pulumi_vault/policy.py +52 -53
- pulumi_vault/provider.py +160 -161
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/quota_lease_count.py +103 -104
- pulumi_vault/quota_rate_limit.py +171 -172
- pulumi_vault/rabbitmq/__init__.py +1 -1
- pulumi_vault/rabbitmq/_inputs.py +50 -51
- pulumi_vault/rabbitmq/outputs.py +34 -35
- pulumi_vault/rabbitmq/secret_backend.py +902 -231
- pulumi_vault/rabbitmq/secret_backend_role.py +79 -80
- pulumi_vault/raft_autopilot.py +137 -138
- pulumi_vault/raft_snapshot_agent_config.py +477 -478
- pulumi_vault/rgp_policy.py +69 -70
- pulumi_vault/saml/__init__.py +1 -1
- pulumi_vault/saml/auth_backend.py +188 -189
- pulumi_vault/saml/auth_backend_role.py +290 -291
- pulumi_vault/scep_auth_backend_role.py +252 -253
- pulumi_vault/secrets/__init__.py +1 -1
- pulumi_vault/secrets/_inputs.py +19 -20
- pulumi_vault/secrets/outputs.py +13 -14
- pulumi_vault/secrets/sync_association.py +88 -89
- pulumi_vault/secrets/sync_aws_destination.py +180 -181
- pulumi_vault/secrets/sync_azure_destination.py +180 -181
- pulumi_vault/secrets/sync_config.py +52 -53
- pulumi_vault/secrets/sync_gcp_destination.py +129 -130
- pulumi_vault/secrets/sync_gh_destination.py +163 -164
- pulumi_vault/secrets/sync_github_apps.py +78 -79
- pulumi_vault/secrets/sync_vercel_destination.py +146 -147
- pulumi_vault/ssh/__init__.py +1 -1
- pulumi_vault/ssh/_inputs.py +13 -14
- pulumi_vault/ssh/get_secret_backend_sign.py +65 -66
- pulumi_vault/ssh/outputs.py +9 -10
- pulumi_vault/ssh/secret_backend_ca.py +217 -124
- pulumi_vault/ssh/secret_backend_role.py +446 -447
- pulumi_vault/terraformcloud/__init__.py +1 -1
- pulumi_vault/terraformcloud/secret_backend.py +833 -155
- pulumi_vault/terraformcloud/secret_creds.py +93 -94
- pulumi_vault/terraformcloud/secret_role.py +117 -118
- pulumi_vault/token.py +301 -302
- pulumi_vault/tokenauth/__init__.py +1 -1
- pulumi_vault/tokenauth/auth_backend_role.py +324 -325
- pulumi_vault/transform/__init__.py +1 -1
- pulumi_vault/transform/alphabet.py +69 -70
- pulumi_vault/transform/get_decode.py +57 -58
- pulumi_vault/transform/get_encode.py +57 -58
- pulumi_vault/transform/role.py +69 -70
- pulumi_vault/transform/template.py +137 -138
- pulumi_vault/transform/transformation.py +171 -172
- pulumi_vault/transit/__init__.py +1 -1
- pulumi_vault/transit/get_cmac.py +47 -48
- pulumi_vault/transit/get_decrypt.py +25 -26
- pulumi_vault/transit/get_encrypt.py +29 -30
- pulumi_vault/transit/get_sign.py +71 -72
- pulumi_vault/transit/get_verify.py +83 -84
- pulumi_vault/transit/secret_backend_key.py +377 -350
- pulumi_vault/transit/secret_cache_config.py +52 -53
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/METADATA +1 -1
- pulumi_vault-7.2.0.dist-info/RECORD +270 -0
- pulumi_vault-7.1.0.dist-info/RECORD +0 -268
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/top_level.txt +0 -0
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import builtins
|
|
6
|
-
import copy
|
|
5
|
+
import builtins as _builtins
|
|
7
6
|
import warnings
|
|
8
7
|
import sys
|
|
9
8
|
import pulumi
|
|
@@ -20,75 +19,75 @@ __all__ = ['SecretBackendRoleArgs', 'SecretBackendRole']
|
|
|
20
19
|
@pulumi.input_type
|
|
21
20
|
class SecretBackendRoleArgs:
|
|
22
21
|
def __init__(__self__, *,
|
|
23
|
-
backend: pulumi.Input[
|
|
24
|
-
credential_type: pulumi.Input[
|
|
25
|
-
default_sts_ttl: Optional[pulumi.Input[
|
|
26
|
-
external_id: Optional[pulumi.Input[
|
|
27
|
-
iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
28
|
-
iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
29
|
-
max_sts_ttl: Optional[pulumi.Input[
|
|
30
|
-
name: Optional[pulumi.Input[
|
|
31
|
-
namespace: Optional[pulumi.Input[
|
|
32
|
-
permissions_boundary_arn: Optional[pulumi.Input[
|
|
33
|
-
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
34
|
-
policy_document: Optional[pulumi.Input[
|
|
35
|
-
role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
36
|
-
session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
37
|
-
user_path: Optional[pulumi.Input[
|
|
22
|
+
backend: pulumi.Input[_builtins.str],
|
|
23
|
+
credential_type: pulumi.Input[_builtins.str],
|
|
24
|
+
default_sts_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
25
|
+
external_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
26
|
+
iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
27
|
+
iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
28
|
+
max_sts_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
29
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
|
+
permissions_boundary_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
32
|
+
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
33
|
+
policy_document: Optional[pulumi.Input[_builtins.str]] = None,
|
|
34
|
+
role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
35
|
+
session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
36
|
+
user_path: Optional[pulumi.Input[_builtins.str]] = None):
|
|
38
37
|
"""
|
|
39
38
|
The set of arguments for constructing a SecretBackendRole resource.
|
|
40
|
-
:param pulumi.Input[
|
|
39
|
+
:param pulumi.Input[_builtins.str] backend: The path the AWS secret backend is mounted at,
|
|
41
40
|
with no leading or trailing `/`s.
|
|
42
|
-
:param pulumi.Input[
|
|
41
|
+
:param pulumi.Input[_builtins.str] credential_type: Specifies the type of credential to be used when
|
|
43
42
|
retrieving credentials from the role. Must be one of `iam_user`, `assumed_role`, or
|
|
44
43
|
`federation_token`.
|
|
45
|
-
:param pulumi.Input[
|
|
44
|
+
:param pulumi.Input[_builtins.int] default_sts_ttl: The default TTL in seconds for STS credentials.
|
|
46
45
|
When a TTL is not specified when STS credentials are requested,
|
|
47
46
|
and a default TTL is specified on the role,
|
|
48
47
|
then this default TTL will be used. Valid only when `credential_type` is one of
|
|
49
48
|
`assumed_role` or `federation_token`.
|
|
50
|
-
:param pulumi.Input[
|
|
49
|
+
:param pulumi.Input[_builtins.str] external_id: External ID to set for assume role creds.
|
|
51
50
|
Valid only when `credential_type` is set to `assumed_role`.
|
|
52
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
51
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] iam_groups: A list of IAM group names. IAM users generated
|
|
53
52
|
against this vault role will be added to these IAM Groups. For a credential
|
|
54
53
|
type of `assumed_role` or `federation_token`, the policies sent to the
|
|
55
54
|
corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the
|
|
56
55
|
policies from each group in `iam_groups` combined with the `policy_document`
|
|
57
56
|
and `policy_arns` parameters.
|
|
58
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
57
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] iam_tags: A map of strings representing key/value pairs
|
|
59
58
|
to be used as tags for any IAM user that is created by this role.
|
|
60
|
-
:param pulumi.Input[
|
|
59
|
+
:param pulumi.Input[_builtins.int] max_sts_ttl: The max allowed TTL in seconds for STS credentials
|
|
61
60
|
(credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
|
|
62
61
|
one of `assumed_role` or `federation_token`.
|
|
63
|
-
:param pulumi.Input[
|
|
62
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this role within the backend.
|
|
64
63
|
Must be unique within the backend.
|
|
65
|
-
:param pulumi.Input[
|
|
64
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
66
65
|
The value should not contain leading or trailing forward slashes.
|
|
67
66
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
68
67
|
*Available only for Vault Enterprise*.
|
|
69
|
-
:param pulumi.Input[
|
|
68
|
+
:param pulumi.Input[_builtins.str] permissions_boundary_arn: The ARN of the AWS Permissions
|
|
70
69
|
Boundary to attach to IAM users created in the role. Valid only when
|
|
71
70
|
`credential_type` is `iam_user`. If not specified, then no permissions boundary
|
|
72
71
|
policy will be attached.
|
|
73
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
72
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] policy_arns: Specifies a list of AWS managed policy ARNs. The
|
|
74
73
|
behavior depends on the credential type. With `iam_user`, the policies will be
|
|
75
74
|
attached to IAM users when they are requested. With `assumed_role` and
|
|
76
75
|
`federation_token`, the policy ARNs will act as a filter on what the credentials
|
|
77
76
|
can do, similar to `policy_document`. When `credential_type` is `iam_user` or
|
|
78
77
|
`federation_token`, at least one of `policy_document` or `policy_arns` must
|
|
79
78
|
be specified.
|
|
80
|
-
:param pulumi.Input[
|
|
79
|
+
:param pulumi.Input[_builtins.str] policy_document: The IAM policy document for the role. The
|
|
81
80
|
behavior depends on the credential type. With `iam_user`, the policy document
|
|
82
81
|
will be attached to the IAM user generated and augment the permissions the IAM
|
|
83
82
|
user has. With `assumed_role` and `federation_token`, the policy document will
|
|
84
83
|
act as a filter on what the credentials can do, similar to `policy_arns`.
|
|
85
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
84
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] role_arns: Specifies the ARNs of the AWS roles this Vault role
|
|
86
85
|
is allowed to assume. Required when `credential_type` is `assumed_role` and
|
|
87
86
|
prohibited otherwise.
|
|
88
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
87
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] session_tags: A map of strings representing key/value pairs to be set
|
|
89
88
|
during assume role creds creation. Valid only when `credential_type` is set to
|
|
90
89
|
`assumed_role`.
|
|
91
|
-
:param pulumi.Input[
|
|
90
|
+
:param pulumi.Input[_builtins.str] user_path: The path for the user name. Valid only when
|
|
92
91
|
`credential_type` is `iam_user`. Default is `/`.
|
|
93
92
|
"""
|
|
94
93
|
pulumi.set(__self__, "backend", backend)
|
|
@@ -120,9 +119,9 @@ class SecretBackendRoleArgs:
|
|
|
120
119
|
if user_path is not None:
|
|
121
120
|
pulumi.set(__self__, "user_path", user_path)
|
|
122
121
|
|
|
123
|
-
@property
|
|
122
|
+
@_builtins.property
|
|
124
123
|
@pulumi.getter
|
|
125
|
-
def backend(self) -> pulumi.Input[
|
|
124
|
+
def backend(self) -> pulumi.Input[_builtins.str]:
|
|
126
125
|
"""
|
|
127
126
|
The path the AWS secret backend is mounted at,
|
|
128
127
|
with no leading or trailing `/`s.
|
|
@@ -130,12 +129,12 @@ class SecretBackendRoleArgs:
|
|
|
130
129
|
return pulumi.get(self, "backend")
|
|
131
130
|
|
|
132
131
|
@backend.setter
|
|
133
|
-
def backend(self, value: pulumi.Input[
|
|
132
|
+
def backend(self, value: pulumi.Input[_builtins.str]):
|
|
134
133
|
pulumi.set(self, "backend", value)
|
|
135
134
|
|
|
136
|
-
@property
|
|
135
|
+
@_builtins.property
|
|
137
136
|
@pulumi.getter(name="credentialType")
|
|
138
|
-
def credential_type(self) -> pulumi.Input[
|
|
137
|
+
def credential_type(self) -> pulumi.Input[_builtins.str]:
|
|
139
138
|
"""
|
|
140
139
|
Specifies the type of credential to be used when
|
|
141
140
|
retrieving credentials from the role. Must be one of `iam_user`, `assumed_role`, or
|
|
@@ -144,12 +143,12 @@ class SecretBackendRoleArgs:
|
|
|
144
143
|
return pulumi.get(self, "credential_type")
|
|
145
144
|
|
|
146
145
|
@credential_type.setter
|
|
147
|
-
def credential_type(self, value: pulumi.Input[
|
|
146
|
+
def credential_type(self, value: pulumi.Input[_builtins.str]):
|
|
148
147
|
pulumi.set(self, "credential_type", value)
|
|
149
148
|
|
|
150
|
-
@property
|
|
149
|
+
@_builtins.property
|
|
151
150
|
@pulumi.getter(name="defaultStsTtl")
|
|
152
|
-
def default_sts_ttl(self) -> Optional[pulumi.Input[
|
|
151
|
+
def default_sts_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
153
152
|
"""
|
|
154
153
|
The default TTL in seconds for STS credentials.
|
|
155
154
|
When a TTL is not specified when STS credentials are requested,
|
|
@@ -160,12 +159,12 @@ class SecretBackendRoleArgs:
|
|
|
160
159
|
return pulumi.get(self, "default_sts_ttl")
|
|
161
160
|
|
|
162
161
|
@default_sts_ttl.setter
|
|
163
|
-
def default_sts_ttl(self, value: Optional[pulumi.Input[
|
|
162
|
+
def default_sts_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
164
163
|
pulumi.set(self, "default_sts_ttl", value)
|
|
165
164
|
|
|
166
|
-
@property
|
|
165
|
+
@_builtins.property
|
|
167
166
|
@pulumi.getter(name="externalId")
|
|
168
|
-
def external_id(self) -> Optional[pulumi.Input[
|
|
167
|
+
def external_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
169
168
|
"""
|
|
170
169
|
External ID to set for assume role creds.
|
|
171
170
|
Valid only when `credential_type` is set to `assumed_role`.
|
|
@@ -173,12 +172,12 @@ class SecretBackendRoleArgs:
|
|
|
173
172
|
return pulumi.get(self, "external_id")
|
|
174
173
|
|
|
175
174
|
@external_id.setter
|
|
176
|
-
def external_id(self, value: Optional[pulumi.Input[
|
|
175
|
+
def external_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
177
176
|
pulumi.set(self, "external_id", value)
|
|
178
177
|
|
|
179
|
-
@property
|
|
178
|
+
@_builtins.property
|
|
180
179
|
@pulumi.getter(name="iamGroups")
|
|
181
|
-
def iam_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
180
|
+
def iam_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
182
181
|
"""
|
|
183
182
|
A list of IAM group names. IAM users generated
|
|
184
183
|
against this vault role will be added to these IAM Groups. For a credential
|
|
@@ -190,12 +189,12 @@ class SecretBackendRoleArgs:
|
|
|
190
189
|
return pulumi.get(self, "iam_groups")
|
|
191
190
|
|
|
192
191
|
@iam_groups.setter
|
|
193
|
-
def iam_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
192
|
+
def iam_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
194
193
|
pulumi.set(self, "iam_groups", value)
|
|
195
194
|
|
|
196
|
-
@property
|
|
195
|
+
@_builtins.property
|
|
197
196
|
@pulumi.getter(name="iamTags")
|
|
198
|
-
def iam_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
197
|
+
def iam_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
199
198
|
"""
|
|
200
199
|
A map of strings representing key/value pairs
|
|
201
200
|
to be used as tags for any IAM user that is created by this role.
|
|
@@ -203,12 +202,12 @@ class SecretBackendRoleArgs:
|
|
|
203
202
|
return pulumi.get(self, "iam_tags")
|
|
204
203
|
|
|
205
204
|
@iam_tags.setter
|
|
206
|
-
def iam_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
205
|
+
def iam_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
207
206
|
pulumi.set(self, "iam_tags", value)
|
|
208
207
|
|
|
209
|
-
@property
|
|
208
|
+
@_builtins.property
|
|
210
209
|
@pulumi.getter(name="maxStsTtl")
|
|
211
|
-
def max_sts_ttl(self) -> Optional[pulumi.Input[
|
|
210
|
+
def max_sts_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
212
211
|
"""
|
|
213
212
|
The max allowed TTL in seconds for STS credentials
|
|
214
213
|
(credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
|
|
@@ -217,12 +216,12 @@ class SecretBackendRoleArgs:
|
|
|
217
216
|
return pulumi.get(self, "max_sts_ttl")
|
|
218
217
|
|
|
219
218
|
@max_sts_ttl.setter
|
|
220
|
-
def max_sts_ttl(self, value: Optional[pulumi.Input[
|
|
219
|
+
def max_sts_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
221
220
|
pulumi.set(self, "max_sts_ttl", value)
|
|
222
221
|
|
|
223
|
-
@property
|
|
222
|
+
@_builtins.property
|
|
224
223
|
@pulumi.getter
|
|
225
|
-
def name(self) -> Optional[pulumi.Input[
|
|
224
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
226
225
|
"""
|
|
227
226
|
The name to identify this role within the backend.
|
|
228
227
|
Must be unique within the backend.
|
|
@@ -230,12 +229,12 @@ class SecretBackendRoleArgs:
|
|
|
230
229
|
return pulumi.get(self, "name")
|
|
231
230
|
|
|
232
231
|
@name.setter
|
|
233
|
-
def name(self, value: Optional[pulumi.Input[
|
|
232
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
234
233
|
pulumi.set(self, "name", value)
|
|
235
234
|
|
|
236
|
-
@property
|
|
235
|
+
@_builtins.property
|
|
237
236
|
@pulumi.getter
|
|
238
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
237
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
239
238
|
"""
|
|
240
239
|
The namespace to provision the resource in.
|
|
241
240
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -245,12 +244,12 @@ class SecretBackendRoleArgs:
|
|
|
245
244
|
return pulumi.get(self, "namespace")
|
|
246
245
|
|
|
247
246
|
@namespace.setter
|
|
248
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
247
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
249
248
|
pulumi.set(self, "namespace", value)
|
|
250
249
|
|
|
251
|
-
@property
|
|
250
|
+
@_builtins.property
|
|
252
251
|
@pulumi.getter(name="permissionsBoundaryArn")
|
|
253
|
-
def permissions_boundary_arn(self) -> Optional[pulumi.Input[
|
|
252
|
+
def permissions_boundary_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
254
253
|
"""
|
|
255
254
|
The ARN of the AWS Permissions
|
|
256
255
|
Boundary to attach to IAM users created in the role. Valid only when
|
|
@@ -260,12 +259,12 @@ class SecretBackendRoleArgs:
|
|
|
260
259
|
return pulumi.get(self, "permissions_boundary_arn")
|
|
261
260
|
|
|
262
261
|
@permissions_boundary_arn.setter
|
|
263
|
-
def permissions_boundary_arn(self, value: Optional[pulumi.Input[
|
|
262
|
+
def permissions_boundary_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
264
263
|
pulumi.set(self, "permissions_boundary_arn", value)
|
|
265
264
|
|
|
266
|
-
@property
|
|
265
|
+
@_builtins.property
|
|
267
266
|
@pulumi.getter(name="policyArns")
|
|
268
|
-
def policy_arns(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
267
|
+
def policy_arns(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
269
268
|
"""
|
|
270
269
|
Specifies a list of AWS managed policy ARNs. The
|
|
271
270
|
behavior depends on the credential type. With `iam_user`, the policies will be
|
|
@@ -278,12 +277,12 @@ class SecretBackendRoleArgs:
|
|
|
278
277
|
return pulumi.get(self, "policy_arns")
|
|
279
278
|
|
|
280
279
|
@policy_arns.setter
|
|
281
|
-
def policy_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
280
|
+
def policy_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
282
281
|
pulumi.set(self, "policy_arns", value)
|
|
283
282
|
|
|
284
|
-
@property
|
|
283
|
+
@_builtins.property
|
|
285
284
|
@pulumi.getter(name="policyDocument")
|
|
286
|
-
def policy_document(self) -> Optional[pulumi.Input[
|
|
285
|
+
def policy_document(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
287
286
|
"""
|
|
288
287
|
The IAM policy document for the role. The
|
|
289
288
|
behavior depends on the credential type. With `iam_user`, the policy document
|
|
@@ -294,12 +293,12 @@ class SecretBackendRoleArgs:
|
|
|
294
293
|
return pulumi.get(self, "policy_document")
|
|
295
294
|
|
|
296
295
|
@policy_document.setter
|
|
297
|
-
def policy_document(self, value: Optional[pulumi.Input[
|
|
296
|
+
def policy_document(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
298
297
|
pulumi.set(self, "policy_document", value)
|
|
299
298
|
|
|
300
|
-
@property
|
|
299
|
+
@_builtins.property
|
|
301
300
|
@pulumi.getter(name="roleArns")
|
|
302
|
-
def role_arns(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
301
|
+
def role_arns(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
303
302
|
"""
|
|
304
303
|
Specifies the ARNs of the AWS roles this Vault role
|
|
305
304
|
is allowed to assume. Required when `credential_type` is `assumed_role` and
|
|
@@ -308,12 +307,12 @@ class SecretBackendRoleArgs:
|
|
|
308
307
|
return pulumi.get(self, "role_arns")
|
|
309
308
|
|
|
310
309
|
@role_arns.setter
|
|
311
|
-
def role_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
310
|
+
def role_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
312
311
|
pulumi.set(self, "role_arns", value)
|
|
313
312
|
|
|
314
|
-
@property
|
|
313
|
+
@_builtins.property
|
|
315
314
|
@pulumi.getter(name="sessionTags")
|
|
316
|
-
def session_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
315
|
+
def session_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
317
316
|
"""
|
|
318
317
|
A map of strings representing key/value pairs to be set
|
|
319
318
|
during assume role creds creation. Valid only when `credential_type` is set to
|
|
@@ -322,12 +321,12 @@ class SecretBackendRoleArgs:
|
|
|
322
321
|
return pulumi.get(self, "session_tags")
|
|
323
322
|
|
|
324
323
|
@session_tags.setter
|
|
325
|
-
def session_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
324
|
+
def session_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
326
325
|
pulumi.set(self, "session_tags", value)
|
|
327
326
|
|
|
328
|
-
@property
|
|
327
|
+
@_builtins.property
|
|
329
328
|
@pulumi.getter(name="userPath")
|
|
330
|
-
def user_path(self) -> Optional[pulumi.Input[
|
|
329
|
+
def user_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
331
330
|
"""
|
|
332
331
|
The path for the user name. Valid only when
|
|
333
332
|
`credential_type` is `iam_user`. Default is `/`.
|
|
@@ -335,82 +334,82 @@ class SecretBackendRoleArgs:
|
|
|
335
334
|
return pulumi.get(self, "user_path")
|
|
336
335
|
|
|
337
336
|
@user_path.setter
|
|
338
|
-
def user_path(self, value: Optional[pulumi.Input[
|
|
337
|
+
def user_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
339
338
|
pulumi.set(self, "user_path", value)
|
|
340
339
|
|
|
341
340
|
|
|
342
341
|
@pulumi.input_type
|
|
343
342
|
class _SecretBackendRoleState:
|
|
344
343
|
def __init__(__self__, *,
|
|
345
|
-
backend: Optional[pulumi.Input[
|
|
346
|
-
credential_type: Optional[pulumi.Input[
|
|
347
|
-
default_sts_ttl: Optional[pulumi.Input[
|
|
348
|
-
external_id: Optional[pulumi.Input[
|
|
349
|
-
iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
350
|
-
iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
351
|
-
max_sts_ttl: Optional[pulumi.Input[
|
|
352
|
-
name: Optional[pulumi.Input[
|
|
353
|
-
namespace: Optional[pulumi.Input[
|
|
354
|
-
permissions_boundary_arn: Optional[pulumi.Input[
|
|
355
|
-
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
356
|
-
policy_document: Optional[pulumi.Input[
|
|
357
|
-
role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
358
|
-
session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
359
|
-
user_path: Optional[pulumi.Input[
|
|
344
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
345
|
+
credential_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
346
|
+
default_sts_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
347
|
+
external_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
348
|
+
iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
349
|
+
iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
350
|
+
max_sts_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
351
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
352
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
353
|
+
permissions_boundary_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
354
|
+
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
355
|
+
policy_document: Optional[pulumi.Input[_builtins.str]] = None,
|
|
356
|
+
role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
357
|
+
session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
358
|
+
user_path: Optional[pulumi.Input[_builtins.str]] = None):
|
|
360
359
|
"""
|
|
361
360
|
Input properties used for looking up and filtering SecretBackendRole resources.
|
|
362
|
-
:param pulumi.Input[
|
|
361
|
+
:param pulumi.Input[_builtins.str] backend: The path the AWS secret backend is mounted at,
|
|
363
362
|
with no leading or trailing `/`s.
|
|
364
|
-
:param pulumi.Input[
|
|
363
|
+
:param pulumi.Input[_builtins.str] credential_type: Specifies the type of credential to be used when
|
|
365
364
|
retrieving credentials from the role. Must be one of `iam_user`, `assumed_role`, or
|
|
366
365
|
`federation_token`.
|
|
367
|
-
:param pulumi.Input[
|
|
366
|
+
:param pulumi.Input[_builtins.int] default_sts_ttl: The default TTL in seconds for STS credentials.
|
|
368
367
|
When a TTL is not specified when STS credentials are requested,
|
|
369
368
|
and a default TTL is specified on the role,
|
|
370
369
|
then this default TTL will be used. Valid only when `credential_type` is one of
|
|
371
370
|
`assumed_role` or `federation_token`.
|
|
372
|
-
:param pulumi.Input[
|
|
371
|
+
:param pulumi.Input[_builtins.str] external_id: External ID to set for assume role creds.
|
|
373
372
|
Valid only when `credential_type` is set to `assumed_role`.
|
|
374
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
373
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] iam_groups: A list of IAM group names. IAM users generated
|
|
375
374
|
against this vault role will be added to these IAM Groups. For a credential
|
|
376
375
|
type of `assumed_role` or `federation_token`, the policies sent to the
|
|
377
376
|
corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the
|
|
378
377
|
policies from each group in `iam_groups` combined with the `policy_document`
|
|
379
378
|
and `policy_arns` parameters.
|
|
380
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
379
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] iam_tags: A map of strings representing key/value pairs
|
|
381
380
|
to be used as tags for any IAM user that is created by this role.
|
|
382
|
-
:param pulumi.Input[
|
|
381
|
+
:param pulumi.Input[_builtins.int] max_sts_ttl: The max allowed TTL in seconds for STS credentials
|
|
383
382
|
(credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
|
|
384
383
|
one of `assumed_role` or `federation_token`.
|
|
385
|
-
:param pulumi.Input[
|
|
384
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this role within the backend.
|
|
386
385
|
Must be unique within the backend.
|
|
387
|
-
:param pulumi.Input[
|
|
386
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
388
387
|
The value should not contain leading or trailing forward slashes.
|
|
389
388
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
390
389
|
*Available only for Vault Enterprise*.
|
|
391
|
-
:param pulumi.Input[
|
|
390
|
+
:param pulumi.Input[_builtins.str] permissions_boundary_arn: The ARN of the AWS Permissions
|
|
392
391
|
Boundary to attach to IAM users created in the role. Valid only when
|
|
393
392
|
`credential_type` is `iam_user`. If not specified, then no permissions boundary
|
|
394
393
|
policy will be attached.
|
|
395
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
394
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] policy_arns: Specifies a list of AWS managed policy ARNs. The
|
|
396
395
|
behavior depends on the credential type. With `iam_user`, the policies will be
|
|
397
396
|
attached to IAM users when they are requested. With `assumed_role` and
|
|
398
397
|
`federation_token`, the policy ARNs will act as a filter on what the credentials
|
|
399
398
|
can do, similar to `policy_document`. When `credential_type` is `iam_user` or
|
|
400
399
|
`federation_token`, at least one of `policy_document` or `policy_arns` must
|
|
401
400
|
be specified.
|
|
402
|
-
:param pulumi.Input[
|
|
401
|
+
:param pulumi.Input[_builtins.str] policy_document: The IAM policy document for the role. The
|
|
403
402
|
behavior depends on the credential type. With `iam_user`, the policy document
|
|
404
403
|
will be attached to the IAM user generated and augment the permissions the IAM
|
|
405
404
|
user has. With `assumed_role` and `federation_token`, the policy document will
|
|
406
405
|
act as a filter on what the credentials can do, similar to `policy_arns`.
|
|
407
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
406
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] role_arns: Specifies the ARNs of the AWS roles this Vault role
|
|
408
407
|
is allowed to assume. Required when `credential_type` is `assumed_role` and
|
|
409
408
|
prohibited otherwise.
|
|
410
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
409
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] session_tags: A map of strings representing key/value pairs to be set
|
|
411
410
|
during assume role creds creation. Valid only when `credential_type` is set to
|
|
412
411
|
`assumed_role`.
|
|
413
|
-
:param pulumi.Input[
|
|
412
|
+
:param pulumi.Input[_builtins.str] user_path: The path for the user name. Valid only when
|
|
414
413
|
`credential_type` is `iam_user`. Default is `/`.
|
|
415
414
|
"""
|
|
416
415
|
if backend is not None:
|
|
@@ -444,9 +443,9 @@ class _SecretBackendRoleState:
|
|
|
444
443
|
if user_path is not None:
|
|
445
444
|
pulumi.set(__self__, "user_path", user_path)
|
|
446
445
|
|
|
447
|
-
@property
|
|
446
|
+
@_builtins.property
|
|
448
447
|
@pulumi.getter
|
|
449
|
-
def backend(self) -> Optional[pulumi.Input[
|
|
448
|
+
def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
450
449
|
"""
|
|
451
450
|
The path the AWS secret backend is mounted at,
|
|
452
451
|
with no leading or trailing `/`s.
|
|
@@ -454,12 +453,12 @@ class _SecretBackendRoleState:
|
|
|
454
453
|
return pulumi.get(self, "backend")
|
|
455
454
|
|
|
456
455
|
@backend.setter
|
|
457
|
-
def backend(self, value: Optional[pulumi.Input[
|
|
456
|
+
def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
458
457
|
pulumi.set(self, "backend", value)
|
|
459
458
|
|
|
460
|
-
@property
|
|
459
|
+
@_builtins.property
|
|
461
460
|
@pulumi.getter(name="credentialType")
|
|
462
|
-
def credential_type(self) -> Optional[pulumi.Input[
|
|
461
|
+
def credential_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
463
462
|
"""
|
|
464
463
|
Specifies the type of credential to be used when
|
|
465
464
|
retrieving credentials from the role. Must be one of `iam_user`, `assumed_role`, or
|
|
@@ -468,12 +467,12 @@ class _SecretBackendRoleState:
|
|
|
468
467
|
return pulumi.get(self, "credential_type")
|
|
469
468
|
|
|
470
469
|
@credential_type.setter
|
|
471
|
-
def credential_type(self, value: Optional[pulumi.Input[
|
|
470
|
+
def credential_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
472
471
|
pulumi.set(self, "credential_type", value)
|
|
473
472
|
|
|
474
|
-
@property
|
|
473
|
+
@_builtins.property
|
|
475
474
|
@pulumi.getter(name="defaultStsTtl")
|
|
476
|
-
def default_sts_ttl(self) -> Optional[pulumi.Input[
|
|
475
|
+
def default_sts_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
477
476
|
"""
|
|
478
477
|
The default TTL in seconds for STS credentials.
|
|
479
478
|
When a TTL is not specified when STS credentials are requested,
|
|
@@ -484,12 +483,12 @@ class _SecretBackendRoleState:
|
|
|
484
483
|
return pulumi.get(self, "default_sts_ttl")
|
|
485
484
|
|
|
486
485
|
@default_sts_ttl.setter
|
|
487
|
-
def default_sts_ttl(self, value: Optional[pulumi.Input[
|
|
486
|
+
def default_sts_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
488
487
|
pulumi.set(self, "default_sts_ttl", value)
|
|
489
488
|
|
|
490
|
-
@property
|
|
489
|
+
@_builtins.property
|
|
491
490
|
@pulumi.getter(name="externalId")
|
|
492
|
-
def external_id(self) -> Optional[pulumi.Input[
|
|
491
|
+
def external_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
493
492
|
"""
|
|
494
493
|
External ID to set for assume role creds.
|
|
495
494
|
Valid only when `credential_type` is set to `assumed_role`.
|
|
@@ -497,12 +496,12 @@ class _SecretBackendRoleState:
|
|
|
497
496
|
return pulumi.get(self, "external_id")
|
|
498
497
|
|
|
499
498
|
@external_id.setter
|
|
500
|
-
def external_id(self, value: Optional[pulumi.Input[
|
|
499
|
+
def external_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
501
500
|
pulumi.set(self, "external_id", value)
|
|
502
501
|
|
|
503
|
-
@property
|
|
502
|
+
@_builtins.property
|
|
504
503
|
@pulumi.getter(name="iamGroups")
|
|
505
|
-
def iam_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
504
|
+
def iam_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
506
505
|
"""
|
|
507
506
|
A list of IAM group names. IAM users generated
|
|
508
507
|
against this vault role will be added to these IAM Groups. For a credential
|
|
@@ -514,12 +513,12 @@ class _SecretBackendRoleState:
|
|
|
514
513
|
return pulumi.get(self, "iam_groups")
|
|
515
514
|
|
|
516
515
|
@iam_groups.setter
|
|
517
|
-
def iam_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
516
|
+
def iam_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
518
517
|
pulumi.set(self, "iam_groups", value)
|
|
519
518
|
|
|
520
|
-
@property
|
|
519
|
+
@_builtins.property
|
|
521
520
|
@pulumi.getter(name="iamTags")
|
|
522
|
-
def iam_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
521
|
+
def iam_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
523
522
|
"""
|
|
524
523
|
A map of strings representing key/value pairs
|
|
525
524
|
to be used as tags for any IAM user that is created by this role.
|
|
@@ -527,12 +526,12 @@ class _SecretBackendRoleState:
|
|
|
527
526
|
return pulumi.get(self, "iam_tags")
|
|
528
527
|
|
|
529
528
|
@iam_tags.setter
|
|
530
|
-
def iam_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
529
|
+
def iam_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
531
530
|
pulumi.set(self, "iam_tags", value)
|
|
532
531
|
|
|
533
|
-
@property
|
|
532
|
+
@_builtins.property
|
|
534
533
|
@pulumi.getter(name="maxStsTtl")
|
|
535
|
-
def max_sts_ttl(self) -> Optional[pulumi.Input[
|
|
534
|
+
def max_sts_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
536
535
|
"""
|
|
537
536
|
The max allowed TTL in seconds for STS credentials
|
|
538
537
|
(credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
|
|
@@ -541,12 +540,12 @@ class _SecretBackendRoleState:
|
|
|
541
540
|
return pulumi.get(self, "max_sts_ttl")
|
|
542
541
|
|
|
543
542
|
@max_sts_ttl.setter
|
|
544
|
-
def max_sts_ttl(self, value: Optional[pulumi.Input[
|
|
543
|
+
def max_sts_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
545
544
|
pulumi.set(self, "max_sts_ttl", value)
|
|
546
545
|
|
|
547
|
-
@property
|
|
546
|
+
@_builtins.property
|
|
548
547
|
@pulumi.getter
|
|
549
|
-
def name(self) -> Optional[pulumi.Input[
|
|
548
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
550
549
|
"""
|
|
551
550
|
The name to identify this role within the backend.
|
|
552
551
|
Must be unique within the backend.
|
|
@@ -554,12 +553,12 @@ class _SecretBackendRoleState:
|
|
|
554
553
|
return pulumi.get(self, "name")
|
|
555
554
|
|
|
556
555
|
@name.setter
|
|
557
|
-
def name(self, value: Optional[pulumi.Input[
|
|
556
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
558
557
|
pulumi.set(self, "name", value)
|
|
559
558
|
|
|
560
|
-
@property
|
|
559
|
+
@_builtins.property
|
|
561
560
|
@pulumi.getter
|
|
562
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
561
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
563
562
|
"""
|
|
564
563
|
The namespace to provision the resource in.
|
|
565
564
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -569,12 +568,12 @@ class _SecretBackendRoleState:
|
|
|
569
568
|
return pulumi.get(self, "namespace")
|
|
570
569
|
|
|
571
570
|
@namespace.setter
|
|
572
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
571
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
573
572
|
pulumi.set(self, "namespace", value)
|
|
574
573
|
|
|
575
|
-
@property
|
|
574
|
+
@_builtins.property
|
|
576
575
|
@pulumi.getter(name="permissionsBoundaryArn")
|
|
577
|
-
def permissions_boundary_arn(self) -> Optional[pulumi.Input[
|
|
576
|
+
def permissions_boundary_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
578
577
|
"""
|
|
579
578
|
The ARN of the AWS Permissions
|
|
580
579
|
Boundary to attach to IAM users created in the role. Valid only when
|
|
@@ -584,12 +583,12 @@ class _SecretBackendRoleState:
|
|
|
584
583
|
return pulumi.get(self, "permissions_boundary_arn")
|
|
585
584
|
|
|
586
585
|
@permissions_boundary_arn.setter
|
|
587
|
-
def permissions_boundary_arn(self, value: Optional[pulumi.Input[
|
|
586
|
+
def permissions_boundary_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
588
587
|
pulumi.set(self, "permissions_boundary_arn", value)
|
|
589
588
|
|
|
590
|
-
@property
|
|
589
|
+
@_builtins.property
|
|
591
590
|
@pulumi.getter(name="policyArns")
|
|
592
|
-
def policy_arns(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
591
|
+
def policy_arns(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
593
592
|
"""
|
|
594
593
|
Specifies a list of AWS managed policy ARNs. The
|
|
595
594
|
behavior depends on the credential type. With `iam_user`, the policies will be
|
|
@@ -602,12 +601,12 @@ class _SecretBackendRoleState:
|
|
|
602
601
|
return pulumi.get(self, "policy_arns")
|
|
603
602
|
|
|
604
603
|
@policy_arns.setter
|
|
605
|
-
def policy_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
604
|
+
def policy_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
606
605
|
pulumi.set(self, "policy_arns", value)
|
|
607
606
|
|
|
608
|
-
@property
|
|
607
|
+
@_builtins.property
|
|
609
608
|
@pulumi.getter(name="policyDocument")
|
|
610
|
-
def policy_document(self) -> Optional[pulumi.Input[
|
|
609
|
+
def policy_document(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
611
610
|
"""
|
|
612
611
|
The IAM policy document for the role. The
|
|
613
612
|
behavior depends on the credential type. With `iam_user`, the policy document
|
|
@@ -618,12 +617,12 @@ class _SecretBackendRoleState:
|
|
|
618
617
|
return pulumi.get(self, "policy_document")
|
|
619
618
|
|
|
620
619
|
@policy_document.setter
|
|
621
|
-
def policy_document(self, value: Optional[pulumi.Input[
|
|
620
|
+
def policy_document(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
622
621
|
pulumi.set(self, "policy_document", value)
|
|
623
622
|
|
|
624
|
-
@property
|
|
623
|
+
@_builtins.property
|
|
625
624
|
@pulumi.getter(name="roleArns")
|
|
626
|
-
def role_arns(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
625
|
+
def role_arns(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
627
626
|
"""
|
|
628
627
|
Specifies the ARNs of the AWS roles this Vault role
|
|
629
628
|
is allowed to assume. Required when `credential_type` is `assumed_role` and
|
|
@@ -632,12 +631,12 @@ class _SecretBackendRoleState:
|
|
|
632
631
|
return pulumi.get(self, "role_arns")
|
|
633
632
|
|
|
634
633
|
@role_arns.setter
|
|
635
|
-
def role_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
634
|
+
def role_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
636
635
|
pulumi.set(self, "role_arns", value)
|
|
637
636
|
|
|
638
|
-
@property
|
|
637
|
+
@_builtins.property
|
|
639
638
|
@pulumi.getter(name="sessionTags")
|
|
640
|
-
def session_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
639
|
+
def session_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
641
640
|
"""
|
|
642
641
|
A map of strings representing key/value pairs to be set
|
|
643
642
|
during assume role creds creation. Valid only when `credential_type` is set to
|
|
@@ -646,12 +645,12 @@ class _SecretBackendRoleState:
|
|
|
646
645
|
return pulumi.get(self, "session_tags")
|
|
647
646
|
|
|
648
647
|
@session_tags.setter
|
|
649
|
-
def session_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
648
|
+
def session_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
650
649
|
pulumi.set(self, "session_tags", value)
|
|
651
650
|
|
|
652
|
-
@property
|
|
651
|
+
@_builtins.property
|
|
653
652
|
@pulumi.getter(name="userPath")
|
|
654
|
-
def user_path(self) -> Optional[pulumi.Input[
|
|
653
|
+
def user_path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
655
654
|
"""
|
|
656
655
|
The path for the user name. Valid only when
|
|
657
656
|
`credential_type` is `iam_user`. Default is `/`.
|
|
@@ -659,7 +658,7 @@ class _SecretBackendRoleState:
|
|
|
659
658
|
return pulumi.get(self, "user_path")
|
|
660
659
|
|
|
661
660
|
@user_path.setter
|
|
662
|
-
def user_path(self, value: Optional[pulumi.Input[
|
|
661
|
+
def user_path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
663
662
|
pulumi.set(self, "user_path", value)
|
|
664
663
|
|
|
665
664
|
|
|
@@ -669,21 +668,21 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
669
668
|
def __init__(__self__,
|
|
670
669
|
resource_name: str,
|
|
671
670
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
672
|
-
backend: Optional[pulumi.Input[
|
|
673
|
-
credential_type: Optional[pulumi.Input[
|
|
674
|
-
default_sts_ttl: Optional[pulumi.Input[
|
|
675
|
-
external_id: Optional[pulumi.Input[
|
|
676
|
-
iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
677
|
-
iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
678
|
-
max_sts_ttl: Optional[pulumi.Input[
|
|
679
|
-
name: Optional[pulumi.Input[
|
|
680
|
-
namespace: Optional[pulumi.Input[
|
|
681
|
-
permissions_boundary_arn: Optional[pulumi.Input[
|
|
682
|
-
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
683
|
-
policy_document: Optional[pulumi.Input[
|
|
684
|
-
role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
685
|
-
session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
686
|
-
user_path: Optional[pulumi.Input[
|
|
671
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
672
|
+
credential_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
673
|
+
default_sts_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
674
|
+
external_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
675
|
+
iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
676
|
+
iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
677
|
+
max_sts_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
678
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
679
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
680
|
+
permissions_boundary_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
681
|
+
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
682
|
+
policy_document: Optional[pulumi.Input[_builtins.str]] = None,
|
|
683
|
+
role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
684
|
+
session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
685
|
+
user_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
687
686
|
__props__=None):
|
|
688
687
|
"""
|
|
689
688
|
## Example Usage
|
|
@@ -722,58 +721,58 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
722
721
|
|
|
723
722
|
:param str resource_name: The name of the resource.
|
|
724
723
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
725
|
-
:param pulumi.Input[
|
|
724
|
+
:param pulumi.Input[_builtins.str] backend: The path the AWS secret backend is mounted at,
|
|
726
725
|
with no leading or trailing `/`s.
|
|
727
|
-
:param pulumi.Input[
|
|
726
|
+
:param pulumi.Input[_builtins.str] credential_type: Specifies the type of credential to be used when
|
|
728
727
|
retrieving credentials from the role. Must be one of `iam_user`, `assumed_role`, or
|
|
729
728
|
`federation_token`.
|
|
730
|
-
:param pulumi.Input[
|
|
729
|
+
:param pulumi.Input[_builtins.int] default_sts_ttl: The default TTL in seconds for STS credentials.
|
|
731
730
|
When a TTL is not specified when STS credentials are requested,
|
|
732
731
|
and a default TTL is specified on the role,
|
|
733
732
|
then this default TTL will be used. Valid only when `credential_type` is one of
|
|
734
733
|
`assumed_role` or `federation_token`.
|
|
735
|
-
:param pulumi.Input[
|
|
734
|
+
:param pulumi.Input[_builtins.str] external_id: External ID to set for assume role creds.
|
|
736
735
|
Valid only when `credential_type` is set to `assumed_role`.
|
|
737
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
736
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] iam_groups: A list of IAM group names. IAM users generated
|
|
738
737
|
against this vault role will be added to these IAM Groups. For a credential
|
|
739
738
|
type of `assumed_role` or `federation_token`, the policies sent to the
|
|
740
739
|
corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the
|
|
741
740
|
policies from each group in `iam_groups` combined with the `policy_document`
|
|
742
741
|
and `policy_arns` parameters.
|
|
743
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
742
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] iam_tags: A map of strings representing key/value pairs
|
|
744
743
|
to be used as tags for any IAM user that is created by this role.
|
|
745
|
-
:param pulumi.Input[
|
|
744
|
+
:param pulumi.Input[_builtins.int] max_sts_ttl: The max allowed TTL in seconds for STS credentials
|
|
746
745
|
(credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
|
|
747
746
|
one of `assumed_role` or `federation_token`.
|
|
748
|
-
:param pulumi.Input[
|
|
747
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this role within the backend.
|
|
749
748
|
Must be unique within the backend.
|
|
750
|
-
:param pulumi.Input[
|
|
749
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
751
750
|
The value should not contain leading or trailing forward slashes.
|
|
752
751
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
753
752
|
*Available only for Vault Enterprise*.
|
|
754
|
-
:param pulumi.Input[
|
|
753
|
+
:param pulumi.Input[_builtins.str] permissions_boundary_arn: The ARN of the AWS Permissions
|
|
755
754
|
Boundary to attach to IAM users created in the role. Valid only when
|
|
756
755
|
`credential_type` is `iam_user`. If not specified, then no permissions boundary
|
|
757
756
|
policy will be attached.
|
|
758
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
757
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] policy_arns: Specifies a list of AWS managed policy ARNs. The
|
|
759
758
|
behavior depends on the credential type. With `iam_user`, the policies will be
|
|
760
759
|
attached to IAM users when they are requested. With `assumed_role` and
|
|
761
760
|
`federation_token`, the policy ARNs will act as a filter on what the credentials
|
|
762
761
|
can do, similar to `policy_document`. When `credential_type` is `iam_user` or
|
|
763
762
|
`federation_token`, at least one of `policy_document` or `policy_arns` must
|
|
764
763
|
be specified.
|
|
765
|
-
:param pulumi.Input[
|
|
764
|
+
:param pulumi.Input[_builtins.str] policy_document: The IAM policy document for the role. The
|
|
766
765
|
behavior depends on the credential type. With `iam_user`, the policy document
|
|
767
766
|
will be attached to the IAM user generated and augment the permissions the IAM
|
|
768
767
|
user has. With `assumed_role` and `federation_token`, the policy document will
|
|
769
768
|
act as a filter on what the credentials can do, similar to `policy_arns`.
|
|
770
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
769
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] role_arns: Specifies the ARNs of the AWS roles this Vault role
|
|
771
770
|
is allowed to assume. Required when `credential_type` is `assumed_role` and
|
|
772
771
|
prohibited otherwise.
|
|
773
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
772
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] session_tags: A map of strings representing key/value pairs to be set
|
|
774
773
|
during assume role creds creation. Valid only when `credential_type` is set to
|
|
775
774
|
`assumed_role`.
|
|
776
|
-
:param pulumi.Input[
|
|
775
|
+
:param pulumi.Input[_builtins.str] user_path: The path for the user name. Valid only when
|
|
777
776
|
`credential_type` is `iam_user`. Default is `/`.
|
|
778
777
|
"""
|
|
779
778
|
...
|
|
@@ -832,21 +831,21 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
832
831
|
def _internal_init(__self__,
|
|
833
832
|
resource_name: str,
|
|
834
833
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
835
|
-
backend: Optional[pulumi.Input[
|
|
836
|
-
credential_type: Optional[pulumi.Input[
|
|
837
|
-
default_sts_ttl: Optional[pulumi.Input[
|
|
838
|
-
external_id: Optional[pulumi.Input[
|
|
839
|
-
iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
840
|
-
iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
841
|
-
max_sts_ttl: Optional[pulumi.Input[
|
|
842
|
-
name: Optional[pulumi.Input[
|
|
843
|
-
namespace: Optional[pulumi.Input[
|
|
844
|
-
permissions_boundary_arn: Optional[pulumi.Input[
|
|
845
|
-
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
846
|
-
policy_document: Optional[pulumi.Input[
|
|
847
|
-
role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
848
|
-
session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
849
|
-
user_path: Optional[pulumi.Input[
|
|
834
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
835
|
+
credential_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
836
|
+
default_sts_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
837
|
+
external_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
838
|
+
iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
839
|
+
iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
840
|
+
max_sts_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
841
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
842
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
843
|
+
permissions_boundary_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
844
|
+
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
845
|
+
policy_document: Optional[pulumi.Input[_builtins.str]] = None,
|
|
846
|
+
role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
847
|
+
session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
848
|
+
user_path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
850
849
|
__props__=None):
|
|
851
850
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
852
851
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -885,21 +884,21 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
885
884
|
def get(resource_name: str,
|
|
886
885
|
id: pulumi.Input[str],
|
|
887
886
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
888
|
-
backend: Optional[pulumi.Input[
|
|
889
|
-
credential_type: Optional[pulumi.Input[
|
|
890
|
-
default_sts_ttl: Optional[pulumi.Input[
|
|
891
|
-
external_id: Optional[pulumi.Input[
|
|
892
|
-
iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
893
|
-
iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
894
|
-
max_sts_ttl: Optional[pulumi.Input[
|
|
895
|
-
name: Optional[pulumi.Input[
|
|
896
|
-
namespace: Optional[pulumi.Input[
|
|
897
|
-
permissions_boundary_arn: Optional[pulumi.Input[
|
|
898
|
-
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
899
|
-
policy_document: Optional[pulumi.Input[
|
|
900
|
-
role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
901
|
-
session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
902
|
-
user_path: Optional[pulumi.Input[
|
|
887
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
888
|
+
credential_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
889
|
+
default_sts_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
890
|
+
external_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
891
|
+
iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
892
|
+
iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
893
|
+
max_sts_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
894
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
895
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
896
|
+
permissions_boundary_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
897
|
+
policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
898
|
+
policy_document: Optional[pulumi.Input[_builtins.str]] = None,
|
|
899
|
+
role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
900
|
+
session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
901
|
+
user_path: Optional[pulumi.Input[_builtins.str]] = None) -> 'SecretBackendRole':
|
|
903
902
|
"""
|
|
904
903
|
Get an existing SecretBackendRole resource's state with the given name, id, and optional extra
|
|
905
904
|
properties used to qualify the lookup.
|
|
@@ -907,58 +906,58 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
907
906
|
:param str resource_name: The unique name of the resulting resource.
|
|
908
907
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
909
908
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
910
|
-
:param pulumi.Input[
|
|
909
|
+
:param pulumi.Input[_builtins.str] backend: The path the AWS secret backend is mounted at,
|
|
911
910
|
with no leading or trailing `/`s.
|
|
912
|
-
:param pulumi.Input[
|
|
911
|
+
:param pulumi.Input[_builtins.str] credential_type: Specifies the type of credential to be used when
|
|
913
912
|
retrieving credentials from the role. Must be one of `iam_user`, `assumed_role`, or
|
|
914
913
|
`federation_token`.
|
|
915
|
-
:param pulumi.Input[
|
|
914
|
+
:param pulumi.Input[_builtins.int] default_sts_ttl: The default TTL in seconds for STS credentials.
|
|
916
915
|
When a TTL is not specified when STS credentials are requested,
|
|
917
916
|
and a default TTL is specified on the role,
|
|
918
917
|
then this default TTL will be used. Valid only when `credential_type` is one of
|
|
919
918
|
`assumed_role` or `federation_token`.
|
|
920
|
-
:param pulumi.Input[
|
|
919
|
+
:param pulumi.Input[_builtins.str] external_id: External ID to set for assume role creds.
|
|
921
920
|
Valid only when `credential_type` is set to `assumed_role`.
|
|
922
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
921
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] iam_groups: A list of IAM group names. IAM users generated
|
|
923
922
|
against this vault role will be added to these IAM Groups. For a credential
|
|
924
923
|
type of `assumed_role` or `federation_token`, the policies sent to the
|
|
925
924
|
corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the
|
|
926
925
|
policies from each group in `iam_groups` combined with the `policy_document`
|
|
927
926
|
and `policy_arns` parameters.
|
|
928
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
927
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] iam_tags: A map of strings representing key/value pairs
|
|
929
928
|
to be used as tags for any IAM user that is created by this role.
|
|
930
|
-
:param pulumi.Input[
|
|
929
|
+
:param pulumi.Input[_builtins.int] max_sts_ttl: The max allowed TTL in seconds for STS credentials
|
|
931
930
|
(credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
|
|
932
931
|
one of `assumed_role` or `federation_token`.
|
|
933
|
-
:param pulumi.Input[
|
|
932
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this role within the backend.
|
|
934
933
|
Must be unique within the backend.
|
|
935
|
-
:param pulumi.Input[
|
|
934
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
936
935
|
The value should not contain leading or trailing forward slashes.
|
|
937
936
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
938
937
|
*Available only for Vault Enterprise*.
|
|
939
|
-
:param pulumi.Input[
|
|
938
|
+
:param pulumi.Input[_builtins.str] permissions_boundary_arn: The ARN of the AWS Permissions
|
|
940
939
|
Boundary to attach to IAM users created in the role. Valid only when
|
|
941
940
|
`credential_type` is `iam_user`. If not specified, then no permissions boundary
|
|
942
941
|
policy will be attached.
|
|
943
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
942
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] policy_arns: Specifies a list of AWS managed policy ARNs. The
|
|
944
943
|
behavior depends on the credential type. With `iam_user`, the policies will be
|
|
945
944
|
attached to IAM users when they are requested. With `assumed_role` and
|
|
946
945
|
`federation_token`, the policy ARNs will act as a filter on what the credentials
|
|
947
946
|
can do, similar to `policy_document`. When `credential_type` is `iam_user` or
|
|
948
947
|
`federation_token`, at least one of `policy_document` or `policy_arns` must
|
|
949
948
|
be specified.
|
|
950
|
-
:param pulumi.Input[
|
|
949
|
+
:param pulumi.Input[_builtins.str] policy_document: The IAM policy document for the role. The
|
|
951
950
|
behavior depends on the credential type. With `iam_user`, the policy document
|
|
952
951
|
will be attached to the IAM user generated and augment the permissions the IAM
|
|
953
952
|
user has. With `assumed_role` and `federation_token`, the policy document will
|
|
954
953
|
act as a filter on what the credentials can do, similar to `policy_arns`.
|
|
955
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
954
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] role_arns: Specifies the ARNs of the AWS roles this Vault role
|
|
956
955
|
is allowed to assume. Required when `credential_type` is `assumed_role` and
|
|
957
956
|
prohibited otherwise.
|
|
958
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
957
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] session_tags: A map of strings representing key/value pairs to be set
|
|
959
958
|
during assume role creds creation. Valid only when `credential_type` is set to
|
|
960
959
|
`assumed_role`.
|
|
961
|
-
:param pulumi.Input[
|
|
960
|
+
:param pulumi.Input[_builtins.str] user_path: The path for the user name. Valid only when
|
|
962
961
|
`credential_type` is `iam_user`. Default is `/`.
|
|
963
962
|
"""
|
|
964
963
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
@@ -982,18 +981,18 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
982
981
|
__props__.__dict__["user_path"] = user_path
|
|
983
982
|
return SecretBackendRole(resource_name, opts=opts, __props__=__props__)
|
|
984
983
|
|
|
985
|
-
@property
|
|
984
|
+
@_builtins.property
|
|
986
985
|
@pulumi.getter
|
|
987
|
-
def backend(self) -> pulumi.Output[
|
|
986
|
+
def backend(self) -> pulumi.Output[_builtins.str]:
|
|
988
987
|
"""
|
|
989
988
|
The path the AWS secret backend is mounted at,
|
|
990
989
|
with no leading or trailing `/`s.
|
|
991
990
|
"""
|
|
992
991
|
return pulumi.get(self, "backend")
|
|
993
992
|
|
|
994
|
-
@property
|
|
993
|
+
@_builtins.property
|
|
995
994
|
@pulumi.getter(name="credentialType")
|
|
996
|
-
def credential_type(self) -> pulumi.Output[
|
|
995
|
+
def credential_type(self) -> pulumi.Output[_builtins.str]:
|
|
997
996
|
"""
|
|
998
997
|
Specifies the type of credential to be used when
|
|
999
998
|
retrieving credentials from the role. Must be one of `iam_user`, `assumed_role`, or
|
|
@@ -1001,9 +1000,9 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
1001
1000
|
"""
|
|
1002
1001
|
return pulumi.get(self, "credential_type")
|
|
1003
1002
|
|
|
1004
|
-
@property
|
|
1003
|
+
@_builtins.property
|
|
1005
1004
|
@pulumi.getter(name="defaultStsTtl")
|
|
1006
|
-
def default_sts_ttl(self) -> pulumi.Output[
|
|
1005
|
+
def default_sts_ttl(self) -> pulumi.Output[_builtins.int]:
|
|
1007
1006
|
"""
|
|
1008
1007
|
The default TTL in seconds for STS credentials.
|
|
1009
1008
|
When a TTL is not specified when STS credentials are requested,
|
|
@@ -1013,18 +1012,18 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
1013
1012
|
"""
|
|
1014
1013
|
return pulumi.get(self, "default_sts_ttl")
|
|
1015
1014
|
|
|
1016
|
-
@property
|
|
1015
|
+
@_builtins.property
|
|
1017
1016
|
@pulumi.getter(name="externalId")
|
|
1018
|
-
def external_id(self) -> pulumi.Output[Optional[
|
|
1017
|
+
def external_id(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1019
1018
|
"""
|
|
1020
1019
|
External ID to set for assume role creds.
|
|
1021
1020
|
Valid only when `credential_type` is set to `assumed_role`.
|
|
1022
1021
|
"""
|
|
1023
1022
|
return pulumi.get(self, "external_id")
|
|
1024
1023
|
|
|
1025
|
-
@property
|
|
1024
|
+
@_builtins.property
|
|
1026
1025
|
@pulumi.getter(name="iamGroups")
|
|
1027
|
-
def iam_groups(self) -> pulumi.Output[Optional[Sequence[
|
|
1026
|
+
def iam_groups(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1028
1027
|
"""
|
|
1029
1028
|
A list of IAM group names. IAM users generated
|
|
1030
1029
|
against this vault role will be added to these IAM Groups. For a credential
|
|
@@ -1035,18 +1034,18 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
1035
1034
|
"""
|
|
1036
1035
|
return pulumi.get(self, "iam_groups")
|
|
1037
1036
|
|
|
1038
|
-
@property
|
|
1037
|
+
@_builtins.property
|
|
1039
1038
|
@pulumi.getter(name="iamTags")
|
|
1040
|
-
def iam_tags(self) -> pulumi.Output[Optional[Mapping[str,
|
|
1039
|
+
def iam_tags(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1041
1040
|
"""
|
|
1042
1041
|
A map of strings representing key/value pairs
|
|
1043
1042
|
to be used as tags for any IAM user that is created by this role.
|
|
1044
1043
|
"""
|
|
1045
1044
|
return pulumi.get(self, "iam_tags")
|
|
1046
1045
|
|
|
1047
|
-
@property
|
|
1046
|
+
@_builtins.property
|
|
1048
1047
|
@pulumi.getter(name="maxStsTtl")
|
|
1049
|
-
def max_sts_ttl(self) -> pulumi.Output[
|
|
1048
|
+
def max_sts_ttl(self) -> pulumi.Output[_builtins.int]:
|
|
1050
1049
|
"""
|
|
1051
1050
|
The max allowed TTL in seconds for STS credentials
|
|
1052
1051
|
(credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
|
|
@@ -1054,18 +1053,18 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
1054
1053
|
"""
|
|
1055
1054
|
return pulumi.get(self, "max_sts_ttl")
|
|
1056
1055
|
|
|
1057
|
-
@property
|
|
1056
|
+
@_builtins.property
|
|
1058
1057
|
@pulumi.getter
|
|
1059
|
-
def name(self) -> pulumi.Output[
|
|
1058
|
+
def name(self) -> pulumi.Output[_builtins.str]:
|
|
1060
1059
|
"""
|
|
1061
1060
|
The name to identify this role within the backend.
|
|
1062
1061
|
Must be unique within the backend.
|
|
1063
1062
|
"""
|
|
1064
1063
|
return pulumi.get(self, "name")
|
|
1065
1064
|
|
|
1066
|
-
@property
|
|
1065
|
+
@_builtins.property
|
|
1067
1066
|
@pulumi.getter
|
|
1068
|
-
def namespace(self) -> pulumi.Output[Optional[
|
|
1067
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1069
1068
|
"""
|
|
1070
1069
|
The namespace to provision the resource in.
|
|
1071
1070
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -1074,9 +1073,9 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
1074
1073
|
"""
|
|
1075
1074
|
return pulumi.get(self, "namespace")
|
|
1076
1075
|
|
|
1077
|
-
@property
|
|
1076
|
+
@_builtins.property
|
|
1078
1077
|
@pulumi.getter(name="permissionsBoundaryArn")
|
|
1079
|
-
def permissions_boundary_arn(self) -> pulumi.Output[Optional[
|
|
1078
|
+
def permissions_boundary_arn(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1080
1079
|
"""
|
|
1081
1080
|
The ARN of the AWS Permissions
|
|
1082
1081
|
Boundary to attach to IAM users created in the role. Valid only when
|
|
@@ -1085,9 +1084,9 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
1085
1084
|
"""
|
|
1086
1085
|
return pulumi.get(self, "permissions_boundary_arn")
|
|
1087
1086
|
|
|
1088
|
-
@property
|
|
1087
|
+
@_builtins.property
|
|
1089
1088
|
@pulumi.getter(name="policyArns")
|
|
1090
|
-
def policy_arns(self) -> pulumi.Output[Optional[Sequence[
|
|
1089
|
+
def policy_arns(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1091
1090
|
"""
|
|
1092
1091
|
Specifies a list of AWS managed policy ARNs. The
|
|
1093
1092
|
behavior depends on the credential type. With `iam_user`, the policies will be
|
|
@@ -1099,9 +1098,9 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
1099
1098
|
"""
|
|
1100
1099
|
return pulumi.get(self, "policy_arns")
|
|
1101
1100
|
|
|
1102
|
-
@property
|
|
1101
|
+
@_builtins.property
|
|
1103
1102
|
@pulumi.getter(name="policyDocument")
|
|
1104
|
-
def policy_document(self) -> pulumi.Output[Optional[
|
|
1103
|
+
def policy_document(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1105
1104
|
"""
|
|
1106
1105
|
The IAM policy document for the role. The
|
|
1107
1106
|
behavior depends on the credential type. With `iam_user`, the policy document
|
|
@@ -1111,9 +1110,9 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
1111
1110
|
"""
|
|
1112
1111
|
return pulumi.get(self, "policy_document")
|
|
1113
1112
|
|
|
1114
|
-
@property
|
|
1113
|
+
@_builtins.property
|
|
1115
1114
|
@pulumi.getter(name="roleArns")
|
|
1116
|
-
def role_arns(self) -> pulumi.Output[Optional[Sequence[
|
|
1115
|
+
def role_arns(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1117
1116
|
"""
|
|
1118
1117
|
Specifies the ARNs of the AWS roles this Vault role
|
|
1119
1118
|
is allowed to assume. Required when `credential_type` is `assumed_role` and
|
|
@@ -1121,9 +1120,9 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
1121
1120
|
"""
|
|
1122
1121
|
return pulumi.get(self, "role_arns")
|
|
1123
1122
|
|
|
1124
|
-
@property
|
|
1123
|
+
@_builtins.property
|
|
1125
1124
|
@pulumi.getter(name="sessionTags")
|
|
1126
|
-
def session_tags(self) -> pulumi.Output[Optional[Mapping[str,
|
|
1125
|
+
def session_tags(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1127
1126
|
"""
|
|
1128
1127
|
A map of strings representing key/value pairs to be set
|
|
1129
1128
|
during assume role creds creation. Valid only when `credential_type` is set to
|
|
@@ -1131,9 +1130,9 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
1131
1130
|
"""
|
|
1132
1131
|
return pulumi.get(self, "session_tags")
|
|
1133
1132
|
|
|
1134
|
-
@property
|
|
1133
|
+
@_builtins.property
|
|
1135
1134
|
@pulumi.getter(name="userPath")
|
|
1136
|
-
def user_path(self) -> pulumi.Output[Optional[
|
|
1135
|
+
def user_path(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1137
1136
|
"""
|
|
1138
1137
|
The path for the user name. Valid only when
|
|
1139
1138
|
`credential_type` is `iam_user`. Default is `/`.
|