pulumi-vault 7.1.0__py3-none-any.whl → 7.2.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +19 -1
- pulumi_vault/_inputs.py +873 -673
- pulumi_vault/ad/__init__.py +1 -1
- pulumi_vault/ad/get_access_credentials.py +27 -28
- pulumi_vault/ad/secret_backend.py +579 -580
- pulumi_vault/ad/secret_library.py +120 -121
- pulumi_vault/ad/secret_role.py +104 -105
- pulumi_vault/alicloud/__init__.py +1 -1
- pulumi_vault/alicloud/auth_backend_role.py +222 -223
- pulumi_vault/approle/__init__.py +1 -1
- pulumi_vault/approle/auth_backend_login.py +138 -139
- pulumi_vault/approle/auth_backend_role.py +292 -293
- pulumi_vault/approle/auth_backend_role_secret_id.py +202 -203
- pulumi_vault/approle/get_auth_backend_role_id.py +23 -24
- pulumi_vault/audit.py +103 -104
- pulumi_vault/audit_request_header.py +52 -53
- pulumi_vault/auth_backend.py +132 -133
- pulumi_vault/aws/__init__.py +1 -1
- pulumi_vault/aws/auth_backend_cert.py +86 -87
- pulumi_vault/aws/auth_backend_client.py +307 -308
- pulumi_vault/aws/auth_backend_config_identity.py +103 -104
- pulumi_vault/aws/auth_backend_identity_whitelist.py +69 -70
- pulumi_vault/aws/auth_backend_login.py +258 -259
- pulumi_vault/aws/auth_backend_role.py +486 -487
- pulumi_vault/aws/auth_backend_role_tag.py +155 -156
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +69 -70
- pulumi_vault/aws/auth_backend_sts_role.py +86 -87
- pulumi_vault/aws/get_access_credentials.py +59 -60
- pulumi_vault/aws/get_static_access_credentials.py +19 -20
- pulumi_vault/aws/secret_backend.py +1016 -439
- pulumi_vault/aws/secret_backend_role.py +256 -257
- pulumi_vault/aws/secret_backend_static_role.py +137 -138
- pulumi_vault/azure/__init__.py +1 -1
- pulumi_vault/azure/_inputs.py +26 -27
- pulumi_vault/azure/auth_backend_config.py +222 -223
- pulumi_vault/azure/auth_backend_role.py +307 -308
- pulumi_vault/azure/backend.py +1057 -285
- pulumi_vault/azure/backend_role.py +194 -195
- pulumi_vault/azure/get_access_credentials.py +75 -76
- pulumi_vault/azure/outputs.py +16 -17
- pulumi_vault/cert_auth_backend_role.py +443 -444
- pulumi_vault/config/__init__.py +1 -1
- pulumi_vault/config/__init__.pyi +1 -2
- pulumi_vault/config/_inputs.py +13 -14
- pulumi_vault/config/outputs.py +380 -381
- pulumi_vault/config/ui_custom_message.py +140 -141
- pulumi_vault/config/vars.py +31 -32
- pulumi_vault/consul/__init__.py +1 -1
- pulumi_vault/consul/secret_backend.py +887 -256
- pulumi_vault/consul/secret_backend_role.py +222 -223
- pulumi_vault/database/__init__.py +1 -1
- pulumi_vault/database/_inputs.py +3167 -3168
- pulumi_vault/database/outputs.py +2123 -2124
- pulumi_vault/database/secret_backend_connection.py +259 -260
- pulumi_vault/database/secret_backend_role.py +205 -206
- pulumi_vault/database/secret_backend_static_role.py +218 -219
- pulumi_vault/database/secrets_mount.py +426 -380
- pulumi_vault/egp_policy.py +86 -87
- pulumi_vault/gcp/__init__.py +1 -1
- pulumi_vault/gcp/_inputs.py +98 -99
- pulumi_vault/gcp/auth_backend.py +322 -323
- pulumi_vault/gcp/auth_backend_role.py +347 -348
- pulumi_vault/gcp/get_auth_backend_role.py +91 -92
- pulumi_vault/gcp/outputs.py +66 -67
- pulumi_vault/gcp/secret_backend.py +878 -336
- pulumi_vault/gcp/secret_impersonated_account.py +112 -113
- pulumi_vault/gcp/secret_roleset.py +115 -116
- pulumi_vault/gcp/secret_static_account.py +115 -116
- pulumi_vault/generic/__init__.py +1 -1
- pulumi_vault/generic/endpoint.py +138 -139
- pulumi_vault/generic/get_secret.py +39 -40
- pulumi_vault/generic/secret.py +95 -96
- pulumi_vault/get_auth_backend.py +29 -30
- pulumi_vault/get_auth_backends.py +19 -20
- pulumi_vault/get_namespace.py +21 -22
- pulumi_vault/get_namespaces.py +19 -20
- pulumi_vault/get_nomad_access_token.py +25 -26
- pulumi_vault/get_policy_document.py +10 -11
- pulumi_vault/get_raft_autopilot_state.py +31 -32
- pulumi_vault/github/__init__.py +1 -1
- pulumi_vault/github/_inputs.py +50 -51
- pulumi_vault/github/auth_backend.py +285 -286
- pulumi_vault/github/outputs.py +34 -35
- pulumi_vault/github/team.py +69 -70
- pulumi_vault/github/user.py +69 -70
- pulumi_vault/identity/__init__.py +1 -1
- pulumi_vault/identity/entity.py +103 -104
- pulumi_vault/identity/entity_alias.py +86 -87
- pulumi_vault/identity/entity_policies.py +78 -79
- pulumi_vault/identity/get_entity.py +62 -63
- pulumi_vault/identity/get_group.py +75 -76
- pulumi_vault/identity/get_oidc_client_creds.py +19 -20
- pulumi_vault/identity/get_oidc_openid_config.py +39 -40
- pulumi_vault/identity/get_oidc_public_keys.py +17 -18
- pulumi_vault/identity/group.py +171 -172
- pulumi_vault/identity/group_alias.py +69 -70
- pulumi_vault/identity/group_member_entity_ids.py +69 -70
- pulumi_vault/identity/group_member_group_ids.py +69 -70
- pulumi_vault/identity/group_policies.py +78 -79
- pulumi_vault/identity/mfa_duo.py +183 -184
- pulumi_vault/identity/mfa_login_enforcement.py +147 -148
- pulumi_vault/identity/mfa_okta.py +166 -167
- pulumi_vault/identity/mfa_pingid.py +160 -161
- pulumi_vault/identity/mfa_totp.py +217 -218
- pulumi_vault/identity/oidc.py +35 -36
- pulumi_vault/identity/oidc_assignment.py +69 -70
- pulumi_vault/identity/oidc_client.py +155 -156
- pulumi_vault/identity/oidc_key.py +103 -104
- pulumi_vault/identity/oidc_key_allowed_client_id.py +52 -53
- pulumi_vault/identity/oidc_provider.py +112 -113
- pulumi_vault/identity/oidc_role.py +103 -104
- pulumi_vault/identity/oidc_scope.py +69 -70
- pulumi_vault/identity/outputs.py +42 -43
- pulumi_vault/jwt/__init__.py +1 -1
- pulumi_vault/jwt/_inputs.py +50 -51
- pulumi_vault/jwt/auth_backend.py +400 -354
- pulumi_vault/jwt/auth_backend_role.py +494 -495
- pulumi_vault/jwt/outputs.py +34 -35
- pulumi_vault/kmip/__init__.py +1 -1
- pulumi_vault/kmip/secret_backend.py +1006 -227
- pulumi_vault/kmip/secret_role.py +358 -359
- pulumi_vault/kmip/secret_scope.py +69 -70
- pulumi_vault/kubernetes/__init__.py +1 -1
- pulumi_vault/kubernetes/auth_backend_config.py +171 -172
- pulumi_vault/kubernetes/auth_backend_role.py +273 -274
- pulumi_vault/kubernetes/get_auth_backend_config.py +57 -58
- pulumi_vault/kubernetes/get_auth_backend_role.py +87 -88
- pulumi_vault/kubernetes/get_service_account_token.py +51 -52
- pulumi_vault/kubernetes/secret_backend.py +431 -385
- pulumi_vault/kubernetes/secret_backend_role.py +239 -240
- pulumi_vault/kv/__init__.py +1 -1
- pulumi_vault/kv/_inputs.py +25 -26
- pulumi_vault/kv/get_secret.py +25 -26
- pulumi_vault/kv/get_secret_subkeys_v2.py +39 -40
- pulumi_vault/kv/get_secret_v2.py +41 -42
- pulumi_vault/kv/get_secrets_list.py +17 -18
- pulumi_vault/kv/get_secrets_list_v2.py +25 -26
- pulumi_vault/kv/outputs.py +17 -18
- pulumi_vault/kv/secret.py +61 -62
- pulumi_vault/kv/secret_backend_v2.py +86 -87
- pulumi_vault/kv/secret_v2.py +184 -185
- pulumi_vault/ldap/__init__.py +1 -1
- pulumi_vault/ldap/auth_backend.py +716 -717
- pulumi_vault/ldap/auth_backend_group.py +69 -70
- pulumi_vault/ldap/auth_backend_user.py +86 -87
- pulumi_vault/ldap/get_dynamic_credentials.py +27 -28
- pulumi_vault/ldap/get_static_credentials.py +29 -30
- pulumi_vault/ldap/secret_backend.py +732 -693
- pulumi_vault/ldap/secret_backend_dynamic_role.py +154 -155
- pulumi_vault/ldap/secret_backend_library_set.py +120 -121
- pulumi_vault/ldap/secret_backend_static_role.py +120 -121
- pulumi_vault/managed/__init__.py +1 -1
- pulumi_vault/managed/_inputs.py +274 -275
- pulumi_vault/managed/keys.py +27 -28
- pulumi_vault/managed/outputs.py +184 -185
- pulumi_vault/mfa_duo.py +137 -138
- pulumi_vault/mfa_okta.py +137 -138
- pulumi_vault/mfa_pingid.py +149 -150
- pulumi_vault/mfa_totp.py +154 -155
- pulumi_vault/mongodbatlas/__init__.py +1 -1
- pulumi_vault/mongodbatlas/secret_backend.py +78 -79
- pulumi_vault/mongodbatlas/secret_role.py +188 -189
- pulumi_vault/mount.py +380 -334
- pulumi_vault/namespace.py +78 -79
- pulumi_vault/nomad_secret_backend.py +909 -271
- pulumi_vault/nomad_secret_role.py +103 -104
- pulumi_vault/oci_auth_backend.py +683 -0
- pulumi_vault/oci_auth_backend_role.py +798 -0
- pulumi_vault/okta/__init__.py +1 -1
- pulumi_vault/okta/_inputs.py +31 -32
- pulumi_vault/okta/auth_backend.py +305 -306
- pulumi_vault/okta/auth_backend_group.py +69 -70
- pulumi_vault/okta/auth_backend_user.py +86 -87
- pulumi_vault/okta/outputs.py +21 -22
- pulumi_vault/outputs.py +234 -82
- pulumi_vault/pkisecret/__init__.py +1 -1
- pulumi_vault/pkisecret/_inputs.py +55 -56
- pulumi_vault/pkisecret/backend_acme_eab.py +116 -117
- pulumi_vault/pkisecret/backend_config_acme.py +175 -176
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +394 -395
- pulumi_vault/pkisecret/backend_config_cluster.py +71 -72
- pulumi_vault/pkisecret/backend_config_cmpv2.py +132 -133
- pulumi_vault/pkisecret/backend_config_est.py +149 -150
- pulumi_vault/pkisecret/backend_config_scep.py +205 -159
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +37 -38
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +32 -33
- pulumi_vault/pkisecret/get_backend_config_est.py +30 -31
- pulumi_vault/pkisecret/get_backend_config_scep.py +50 -31
- pulumi_vault/pkisecret/get_backend_issuer.py +63 -64
- pulumi_vault/pkisecret/get_backend_issuers.py +23 -24
- pulumi_vault/pkisecret/get_backend_key.py +29 -30
- pulumi_vault/pkisecret/get_backend_keys.py +23 -24
- pulumi_vault/pkisecret/outputs.py +61 -62
- pulumi_vault/pkisecret/secret_backend_cert.py +415 -416
- pulumi_vault/pkisecret/secret_backend_config_ca.py +54 -55
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +75 -76
- pulumi_vault/pkisecret/secret_backend_config_urls.py +105 -106
- pulumi_vault/pkisecret/secret_backend_crl_config.py +241 -242
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +515 -516
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +78 -79
- pulumi_vault/pkisecret/secret_backend_issuer.py +286 -287
- pulumi_vault/pkisecret/secret_backend_key.py +146 -147
- pulumi_vault/pkisecret/secret_backend_role.py +873 -874
- pulumi_vault/pkisecret/secret_backend_root_cert.py +677 -678
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +660 -661
- pulumi_vault/pkisecret/secret_backend_sign.py +346 -347
- pulumi_vault/plugin.py +154 -155
- pulumi_vault/plugin_pinned_version.py +52 -53
- pulumi_vault/policy.py +52 -53
- pulumi_vault/provider.py +160 -161
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/quota_lease_count.py +103 -104
- pulumi_vault/quota_rate_limit.py +171 -172
- pulumi_vault/rabbitmq/__init__.py +1 -1
- pulumi_vault/rabbitmq/_inputs.py +50 -51
- pulumi_vault/rabbitmq/outputs.py +34 -35
- pulumi_vault/rabbitmq/secret_backend.py +902 -231
- pulumi_vault/rabbitmq/secret_backend_role.py +79 -80
- pulumi_vault/raft_autopilot.py +137 -138
- pulumi_vault/raft_snapshot_agent_config.py +477 -478
- pulumi_vault/rgp_policy.py +69 -70
- pulumi_vault/saml/__init__.py +1 -1
- pulumi_vault/saml/auth_backend.py +188 -189
- pulumi_vault/saml/auth_backend_role.py +290 -291
- pulumi_vault/scep_auth_backend_role.py +252 -253
- pulumi_vault/secrets/__init__.py +1 -1
- pulumi_vault/secrets/_inputs.py +19 -20
- pulumi_vault/secrets/outputs.py +13 -14
- pulumi_vault/secrets/sync_association.py +88 -89
- pulumi_vault/secrets/sync_aws_destination.py +180 -181
- pulumi_vault/secrets/sync_azure_destination.py +180 -181
- pulumi_vault/secrets/sync_config.py +52 -53
- pulumi_vault/secrets/sync_gcp_destination.py +129 -130
- pulumi_vault/secrets/sync_gh_destination.py +163 -164
- pulumi_vault/secrets/sync_github_apps.py +78 -79
- pulumi_vault/secrets/sync_vercel_destination.py +146 -147
- pulumi_vault/ssh/__init__.py +1 -1
- pulumi_vault/ssh/_inputs.py +13 -14
- pulumi_vault/ssh/get_secret_backend_sign.py +65 -66
- pulumi_vault/ssh/outputs.py +9 -10
- pulumi_vault/ssh/secret_backend_ca.py +217 -124
- pulumi_vault/ssh/secret_backend_role.py +446 -447
- pulumi_vault/terraformcloud/__init__.py +1 -1
- pulumi_vault/terraformcloud/secret_backend.py +833 -155
- pulumi_vault/terraformcloud/secret_creds.py +93 -94
- pulumi_vault/terraformcloud/secret_role.py +117 -118
- pulumi_vault/token.py +301 -302
- pulumi_vault/tokenauth/__init__.py +1 -1
- pulumi_vault/tokenauth/auth_backend_role.py +324 -325
- pulumi_vault/transform/__init__.py +1 -1
- pulumi_vault/transform/alphabet.py +69 -70
- pulumi_vault/transform/get_decode.py +57 -58
- pulumi_vault/transform/get_encode.py +57 -58
- pulumi_vault/transform/role.py +69 -70
- pulumi_vault/transform/template.py +137 -138
- pulumi_vault/transform/transformation.py +171 -172
- pulumi_vault/transit/__init__.py +1 -1
- pulumi_vault/transit/get_cmac.py +47 -48
- pulumi_vault/transit/get_decrypt.py +25 -26
- pulumi_vault/transit/get_encrypt.py +29 -30
- pulumi_vault/transit/get_sign.py +71 -72
- pulumi_vault/transit/get_verify.py +83 -84
- pulumi_vault/transit/secret_backend_key.py +377 -350
- pulumi_vault/transit/secret_cache_config.py +52 -53
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/METADATA +1 -1
- pulumi_vault-7.2.0.dist-info/RECORD +270 -0
- pulumi_vault-7.1.0.dist-info/RECORD +0 -268
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/top_level.txt +0 -0
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import builtins
|
|
6
|
-
import copy
|
|
5
|
+
import builtins as _builtins
|
|
7
6
|
import warnings
|
|
8
7
|
import sys
|
|
9
8
|
import pulumi
|
|
@@ -20,147 +19,251 @@ __all__ = ['SecretBackendArgs', 'SecretBackend']
|
|
|
20
19
|
@pulumi.input_type
|
|
21
20
|
class SecretBackendArgs:
|
|
22
21
|
def __init__(__self__, *,
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
22
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
23
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
24
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
25
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
26
|
+
credentials: Optional[pulumi.Input[_builtins.str]] = None,
|
|
27
|
+
credentials_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
28
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
29
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
30
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
32
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
33
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
34
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
35
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
36
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
38
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
39
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
40
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
41
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
42
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
43
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
44
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
45
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
46
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
47
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
48
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
49
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
50
|
+
service_account_email: Optional[pulumi.Input[_builtins.str]] = None):
|
|
40
51
|
"""
|
|
41
52
|
The set of arguments for constructing a SecretBackend resource.
|
|
42
|
-
:param pulumi.Input[
|
|
43
|
-
:param pulumi.Input[
|
|
44
|
-
:param pulumi.Input[
|
|
45
|
-
|
|
46
|
-
:param pulumi.Input[
|
|
47
|
-
:param pulumi.Input[
|
|
53
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
54
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
55
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
56
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
57
|
+
:param pulumi.Input[_builtins.str] credentials: JSON-encoded credentials to use to connect to GCP
|
|
58
|
+
:param pulumi.Input[_builtins.int] credentials_wo_version: The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
59
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
60
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
61
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
62
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
48
63
|
*Available only for Vault Enterprise*.
|
|
49
|
-
:param pulumi.Input[
|
|
64
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
50
65
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
51
|
-
:param pulumi.Input[
|
|
66
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
67
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
68
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value for plugin identity
|
|
52
69
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
53
70
|
Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
54
|
-
:param pulumi.Input[
|
|
55
|
-
|
|
56
|
-
:param pulumi.Input[
|
|
57
|
-
:param pulumi.Input[
|
|
58
|
-
:param pulumi.Input[
|
|
59
|
-
|
|
60
|
-
:param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
|
|
71
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
72
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated tokens.
|
|
73
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
74
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
75
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
76
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
61
77
|
The value should not contain leading or trailing forward slashes.
|
|
62
78
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
63
79
|
*Available only for Vault Enterprise*.
|
|
64
|
-
:param pulumi.Input[
|
|
80
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
81
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
82
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
65
83
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
66
|
-
:param pulumi.Input[
|
|
84
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
85
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
67
86
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
68
87
|
*Available only for Vault Enterprise*.
|
|
69
|
-
:param pulumi.Input[
|
|
88
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
70
89
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
71
|
-
:param pulumi.Input[
|
|
90
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
72
91
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
73
92
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
74
|
-
:param pulumi.Input[
|
|
93
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
94
|
+
:param pulumi.Input[_builtins.str] service_account_email: Service Account to impersonate for plugin workload identity federation.
|
|
75
95
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
76
96
|
"""
|
|
97
|
+
if allowed_managed_keys is not None:
|
|
98
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
99
|
+
if allowed_response_headers is not None:
|
|
100
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
101
|
+
if audit_non_hmac_request_keys is not None:
|
|
102
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
103
|
+
if audit_non_hmac_response_keys is not None:
|
|
104
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
77
105
|
if credentials is not None:
|
|
78
106
|
pulumi.set(__self__, "credentials", credentials)
|
|
79
107
|
if credentials_wo_version is not None:
|
|
80
108
|
pulumi.set(__self__, "credentials_wo_version", credentials_wo_version)
|
|
81
109
|
if default_lease_ttl_seconds is not None:
|
|
82
110
|
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
111
|
+
if delegated_auth_accessors is not None:
|
|
112
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
83
113
|
if description is not None:
|
|
84
114
|
pulumi.set(__self__, "description", description)
|
|
85
115
|
if disable_automated_rotation is not None:
|
|
86
116
|
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
87
117
|
if disable_remount is not None:
|
|
88
118
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
119
|
+
if external_entropy_access is not None:
|
|
120
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
121
|
+
if force_no_cache is not None:
|
|
122
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
89
123
|
if identity_token_audience is not None:
|
|
90
124
|
pulumi.set(__self__, "identity_token_audience", identity_token_audience)
|
|
91
125
|
if identity_token_key is not None:
|
|
92
126
|
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
93
127
|
if identity_token_ttl is not None:
|
|
94
128
|
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
129
|
+
if listing_visibility is not None:
|
|
130
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
95
131
|
if local is not None:
|
|
96
132
|
pulumi.set(__self__, "local", local)
|
|
97
133
|
if max_lease_ttl_seconds is not None:
|
|
98
134
|
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
99
135
|
if namespace is not None:
|
|
100
136
|
pulumi.set(__self__, "namespace", namespace)
|
|
137
|
+
if options is not None:
|
|
138
|
+
pulumi.set(__self__, "options", options)
|
|
139
|
+
if passthrough_request_headers is not None:
|
|
140
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
101
141
|
if path is not None:
|
|
102
142
|
pulumi.set(__self__, "path", path)
|
|
143
|
+
if plugin_version is not None:
|
|
144
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
103
145
|
if rotation_period is not None:
|
|
104
146
|
pulumi.set(__self__, "rotation_period", rotation_period)
|
|
105
147
|
if rotation_schedule is not None:
|
|
106
148
|
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
107
149
|
if rotation_window is not None:
|
|
108
150
|
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
151
|
+
if seal_wrap is not None:
|
|
152
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
109
153
|
if service_account_email is not None:
|
|
110
154
|
pulumi.set(__self__, "service_account_email", service_account_email)
|
|
111
155
|
|
|
112
|
-
@property
|
|
156
|
+
@_builtins.property
|
|
157
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
158
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
159
|
+
"""
|
|
160
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
161
|
+
"""
|
|
162
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
163
|
+
|
|
164
|
+
@allowed_managed_keys.setter
|
|
165
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
166
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
167
|
+
|
|
168
|
+
@_builtins.property
|
|
169
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
170
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
171
|
+
"""
|
|
172
|
+
List of headers to allow and pass from the request to the plugin
|
|
173
|
+
"""
|
|
174
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
175
|
+
|
|
176
|
+
@allowed_response_headers.setter
|
|
177
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
178
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
179
|
+
|
|
180
|
+
@_builtins.property
|
|
181
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
182
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
183
|
+
"""
|
|
184
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
185
|
+
"""
|
|
186
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
187
|
+
|
|
188
|
+
@audit_non_hmac_request_keys.setter
|
|
189
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
190
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
191
|
+
|
|
192
|
+
@_builtins.property
|
|
193
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
194
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
195
|
+
"""
|
|
196
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
197
|
+
"""
|
|
198
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
199
|
+
|
|
200
|
+
@audit_non_hmac_response_keys.setter
|
|
201
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
202
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
203
|
+
|
|
204
|
+
@_builtins.property
|
|
113
205
|
@pulumi.getter
|
|
114
|
-
def credentials(self) -> Optional[pulumi.Input[
|
|
206
|
+
def credentials(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
115
207
|
"""
|
|
116
208
|
JSON-encoded credentials to use to connect to GCP
|
|
117
209
|
"""
|
|
118
210
|
return pulumi.get(self, "credentials")
|
|
119
211
|
|
|
120
212
|
@credentials.setter
|
|
121
|
-
def credentials(self, value: Optional[pulumi.Input[
|
|
213
|
+
def credentials(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
122
214
|
pulumi.set(self, "credentials", value)
|
|
123
215
|
|
|
124
|
-
@property
|
|
216
|
+
@_builtins.property
|
|
125
217
|
@pulumi.getter(name="credentialsWoVersion")
|
|
126
|
-
def credentials_wo_version(self) -> Optional[pulumi.Input[
|
|
218
|
+
def credentials_wo_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
127
219
|
"""
|
|
128
220
|
The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
129
221
|
"""
|
|
130
222
|
return pulumi.get(self, "credentials_wo_version")
|
|
131
223
|
|
|
132
224
|
@credentials_wo_version.setter
|
|
133
|
-
def credentials_wo_version(self, value: Optional[pulumi.Input[
|
|
225
|
+
def credentials_wo_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
134
226
|
pulumi.set(self, "credentials_wo_version", value)
|
|
135
227
|
|
|
136
|
-
@property
|
|
228
|
+
@_builtins.property
|
|
137
229
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
138
|
-
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[
|
|
230
|
+
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
139
231
|
"""
|
|
140
|
-
|
|
141
|
-
issued by this backend. Defaults to '0'.
|
|
232
|
+
Default lease duration for secrets in seconds
|
|
142
233
|
"""
|
|
143
234
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
144
235
|
|
|
145
236
|
@default_lease_ttl_seconds.setter
|
|
146
|
-
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[
|
|
237
|
+
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
147
238
|
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
148
239
|
|
|
149
|
-
@property
|
|
240
|
+
@_builtins.property
|
|
241
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
242
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
243
|
+
"""
|
|
244
|
+
List of headers to allow and pass from the request to the plugin
|
|
245
|
+
"""
|
|
246
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
247
|
+
|
|
248
|
+
@delegated_auth_accessors.setter
|
|
249
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
250
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
251
|
+
|
|
252
|
+
@_builtins.property
|
|
150
253
|
@pulumi.getter
|
|
151
|
-
def description(self) -> Optional[pulumi.Input[
|
|
254
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
152
255
|
"""
|
|
153
|
-
|
|
256
|
+
Human-friendly description of the mount for the backend.
|
|
154
257
|
"""
|
|
155
258
|
return pulumi.get(self, "description")
|
|
156
259
|
|
|
157
260
|
@description.setter
|
|
158
|
-
def description(self, value: Optional[pulumi.Input[
|
|
261
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
159
262
|
pulumi.set(self, "description", value)
|
|
160
263
|
|
|
161
|
-
@property
|
|
264
|
+
@_builtins.property
|
|
162
265
|
@pulumi.getter(name="disableAutomatedRotation")
|
|
163
|
-
def disable_automated_rotation(self) -> Optional[pulumi.Input[
|
|
266
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
164
267
|
"""
|
|
165
268
|
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
166
269
|
*Available only for Vault Enterprise*.
|
|
@@ -168,12 +271,12 @@ class SecretBackendArgs:
|
|
|
168
271
|
return pulumi.get(self, "disable_automated_rotation")
|
|
169
272
|
|
|
170
273
|
@disable_automated_rotation.setter
|
|
171
|
-
def disable_automated_rotation(self, value: Optional[pulumi.Input[
|
|
274
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
172
275
|
pulumi.set(self, "disable_automated_rotation", value)
|
|
173
276
|
|
|
174
|
-
@property
|
|
277
|
+
@_builtins.property
|
|
175
278
|
@pulumi.getter(name="disableRemount")
|
|
176
|
-
def disable_remount(self) -> Optional[pulumi.Input[
|
|
279
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
177
280
|
"""
|
|
178
281
|
If set, opts out of mount migration on path updates.
|
|
179
282
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
@@ -181,12 +284,36 @@ class SecretBackendArgs:
|
|
|
181
284
|
return pulumi.get(self, "disable_remount")
|
|
182
285
|
|
|
183
286
|
@disable_remount.setter
|
|
184
|
-
def disable_remount(self, value: Optional[pulumi.Input[
|
|
287
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
185
288
|
pulumi.set(self, "disable_remount", value)
|
|
186
289
|
|
|
187
|
-
@property
|
|
290
|
+
@_builtins.property
|
|
291
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
292
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
293
|
+
"""
|
|
294
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
295
|
+
"""
|
|
296
|
+
return pulumi.get(self, "external_entropy_access")
|
|
297
|
+
|
|
298
|
+
@external_entropy_access.setter
|
|
299
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
300
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
301
|
+
|
|
302
|
+
@_builtins.property
|
|
303
|
+
@pulumi.getter(name="forceNoCache")
|
|
304
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
305
|
+
"""
|
|
306
|
+
If set to true, disables caching.
|
|
307
|
+
"""
|
|
308
|
+
return pulumi.get(self, "force_no_cache")
|
|
309
|
+
|
|
310
|
+
@force_no_cache.setter
|
|
311
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
312
|
+
pulumi.set(self, "force_no_cache", value)
|
|
313
|
+
|
|
314
|
+
@_builtins.property
|
|
188
315
|
@pulumi.getter(name="identityTokenAudience")
|
|
189
|
-
def identity_token_audience(self) -> Optional[pulumi.Input[
|
|
316
|
+
def identity_token_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
190
317
|
"""
|
|
191
318
|
The audience claim value for plugin identity
|
|
192
319
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
@@ -195,62 +322,72 @@ class SecretBackendArgs:
|
|
|
195
322
|
return pulumi.get(self, "identity_token_audience")
|
|
196
323
|
|
|
197
324
|
@identity_token_audience.setter
|
|
198
|
-
def identity_token_audience(self, value: Optional[pulumi.Input[
|
|
325
|
+
def identity_token_audience(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
199
326
|
pulumi.set(self, "identity_token_audience", value)
|
|
200
327
|
|
|
201
|
-
@property
|
|
328
|
+
@_builtins.property
|
|
202
329
|
@pulumi.getter(name="identityTokenKey")
|
|
203
|
-
def identity_token_key(self) -> Optional[pulumi.Input[
|
|
330
|
+
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
204
331
|
"""
|
|
205
|
-
The key to use for signing
|
|
206
|
-
tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
332
|
+
The key to use for signing identity tokens.
|
|
207
333
|
"""
|
|
208
334
|
return pulumi.get(self, "identity_token_key")
|
|
209
335
|
|
|
210
336
|
@identity_token_key.setter
|
|
211
|
-
def identity_token_key(self, value: Optional[pulumi.Input[
|
|
337
|
+
def identity_token_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
212
338
|
pulumi.set(self, "identity_token_key", value)
|
|
213
339
|
|
|
214
|
-
@property
|
|
340
|
+
@_builtins.property
|
|
215
341
|
@pulumi.getter(name="identityTokenTtl")
|
|
216
|
-
def identity_token_ttl(self) -> Optional[pulumi.Input[
|
|
342
|
+
def identity_token_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
217
343
|
"""
|
|
218
344
|
The TTL of generated tokens.
|
|
219
345
|
"""
|
|
220
346
|
return pulumi.get(self, "identity_token_ttl")
|
|
221
347
|
|
|
222
348
|
@identity_token_ttl.setter
|
|
223
|
-
def identity_token_ttl(self, value: Optional[pulumi.Input[
|
|
349
|
+
def identity_token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
224
350
|
pulumi.set(self, "identity_token_ttl", value)
|
|
225
351
|
|
|
226
|
-
@property
|
|
352
|
+
@_builtins.property
|
|
353
|
+
@pulumi.getter(name="listingVisibility")
|
|
354
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
355
|
+
"""
|
|
356
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
357
|
+
"""
|
|
358
|
+
return pulumi.get(self, "listing_visibility")
|
|
359
|
+
|
|
360
|
+
@listing_visibility.setter
|
|
361
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
362
|
+
pulumi.set(self, "listing_visibility", value)
|
|
363
|
+
|
|
364
|
+
@_builtins.property
|
|
227
365
|
@pulumi.getter
|
|
228
|
-
def local(self) -> Optional[pulumi.Input[
|
|
366
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
229
367
|
"""
|
|
230
|
-
|
|
368
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
231
369
|
"""
|
|
232
370
|
return pulumi.get(self, "local")
|
|
233
371
|
|
|
234
372
|
@local.setter
|
|
235
|
-
def local(self, value: Optional[pulumi.Input[
|
|
373
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
236
374
|
pulumi.set(self, "local", value)
|
|
237
375
|
|
|
238
|
-
@property
|
|
376
|
+
@_builtins.property
|
|
239
377
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
240
|
-
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[
|
|
378
|
+
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
241
379
|
"""
|
|
242
|
-
|
|
243
|
-
for credentials issued by this backend. Defaults to '0'.
|
|
380
|
+
Maximum possible lease duration for secrets in seconds
|
|
244
381
|
"""
|
|
245
382
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
246
383
|
|
|
247
384
|
@max_lease_ttl_seconds.setter
|
|
248
|
-
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[
|
|
385
|
+
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
249
386
|
pulumi.set(self, "max_lease_ttl_seconds", value)
|
|
250
387
|
|
|
251
|
-
@property
|
|
388
|
+
@_builtins.property
|
|
252
389
|
@pulumi.getter
|
|
253
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
390
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
254
391
|
"""
|
|
255
392
|
The namespace to provision the resource in.
|
|
256
393
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -260,12 +397,36 @@ class SecretBackendArgs:
|
|
|
260
397
|
return pulumi.get(self, "namespace")
|
|
261
398
|
|
|
262
399
|
@namespace.setter
|
|
263
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
400
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
264
401
|
pulumi.set(self, "namespace", value)
|
|
265
402
|
|
|
266
|
-
@property
|
|
403
|
+
@_builtins.property
|
|
404
|
+
@pulumi.getter
|
|
405
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
406
|
+
"""
|
|
407
|
+
Specifies mount type specific options that are passed to the backend
|
|
408
|
+
"""
|
|
409
|
+
return pulumi.get(self, "options")
|
|
410
|
+
|
|
411
|
+
@options.setter
|
|
412
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
413
|
+
pulumi.set(self, "options", value)
|
|
414
|
+
|
|
415
|
+
@_builtins.property
|
|
416
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
417
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
418
|
+
"""
|
|
419
|
+
List of headers to allow and pass from the request to the plugin
|
|
420
|
+
"""
|
|
421
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
422
|
+
|
|
423
|
+
@passthrough_request_headers.setter
|
|
424
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
425
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
426
|
+
|
|
427
|
+
@_builtins.property
|
|
267
428
|
@pulumi.getter
|
|
268
|
-
def path(self) -> Optional[pulumi.Input[
|
|
429
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
269
430
|
"""
|
|
270
431
|
The unique path this backend should be mounted at. Must
|
|
271
432
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
@@ -273,12 +434,24 @@ class SecretBackendArgs:
|
|
|
273
434
|
return pulumi.get(self, "path")
|
|
274
435
|
|
|
275
436
|
@path.setter
|
|
276
|
-
def path(self, value: Optional[pulumi.Input[
|
|
437
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
277
438
|
pulumi.set(self, "path", value)
|
|
278
439
|
|
|
279
|
-
@property
|
|
440
|
+
@_builtins.property
|
|
441
|
+
@pulumi.getter(name="pluginVersion")
|
|
442
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
443
|
+
"""
|
|
444
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
445
|
+
"""
|
|
446
|
+
return pulumi.get(self, "plugin_version")
|
|
447
|
+
|
|
448
|
+
@plugin_version.setter
|
|
449
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
450
|
+
pulumi.set(self, "plugin_version", value)
|
|
451
|
+
|
|
452
|
+
@_builtins.property
|
|
280
453
|
@pulumi.getter(name="rotationPeriod")
|
|
281
|
-
def rotation_period(self) -> Optional[pulumi.Input[
|
|
454
|
+
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
282
455
|
"""
|
|
283
456
|
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
284
457
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
@@ -287,12 +460,12 @@ class SecretBackendArgs:
|
|
|
287
460
|
return pulumi.get(self, "rotation_period")
|
|
288
461
|
|
|
289
462
|
@rotation_period.setter
|
|
290
|
-
def rotation_period(self, value: Optional[pulumi.Input[
|
|
463
|
+
def rotation_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
291
464
|
pulumi.set(self, "rotation_period", value)
|
|
292
465
|
|
|
293
|
-
@property
|
|
466
|
+
@_builtins.property
|
|
294
467
|
@pulumi.getter(name="rotationSchedule")
|
|
295
|
-
def rotation_schedule(self) -> Optional[pulumi.Input[
|
|
468
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
296
469
|
"""
|
|
297
470
|
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
298
471
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
@@ -300,12 +473,12 @@ class SecretBackendArgs:
|
|
|
300
473
|
return pulumi.get(self, "rotation_schedule")
|
|
301
474
|
|
|
302
475
|
@rotation_schedule.setter
|
|
303
|
-
def rotation_schedule(self, value: Optional[pulumi.Input[
|
|
476
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
304
477
|
pulumi.set(self, "rotation_schedule", value)
|
|
305
478
|
|
|
306
|
-
@property
|
|
479
|
+
@_builtins.property
|
|
307
480
|
@pulumi.getter(name="rotationWindow")
|
|
308
|
-
def rotation_window(self) -> Optional[pulumi.Input[
|
|
481
|
+
def rotation_window(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
309
482
|
"""
|
|
310
483
|
The maximum amount of time in seconds allowed to complete
|
|
311
484
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
@@ -314,12 +487,24 @@ class SecretBackendArgs:
|
|
|
314
487
|
return pulumi.get(self, "rotation_window")
|
|
315
488
|
|
|
316
489
|
@rotation_window.setter
|
|
317
|
-
def rotation_window(self, value: Optional[pulumi.Input[
|
|
490
|
+
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
318
491
|
pulumi.set(self, "rotation_window", value)
|
|
319
492
|
|
|
320
|
-
@property
|
|
493
|
+
@_builtins.property
|
|
494
|
+
@pulumi.getter(name="sealWrap")
|
|
495
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
496
|
+
"""
|
|
497
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
498
|
+
"""
|
|
499
|
+
return pulumi.get(self, "seal_wrap")
|
|
500
|
+
|
|
501
|
+
@seal_wrap.setter
|
|
502
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
503
|
+
pulumi.set(self, "seal_wrap", value)
|
|
504
|
+
|
|
505
|
+
@_builtins.property
|
|
321
506
|
@pulumi.getter(name="serviceAccountEmail")
|
|
322
|
-
def service_account_email(self) -> Optional[pulumi.Input[
|
|
507
|
+
def service_account_email(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
323
508
|
"""
|
|
324
509
|
Service Account to impersonate for plugin workload identity federation.
|
|
325
510
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
@@ -327,170 +512,274 @@ class SecretBackendArgs:
|
|
|
327
512
|
return pulumi.get(self, "service_account_email")
|
|
328
513
|
|
|
329
514
|
@service_account_email.setter
|
|
330
|
-
def service_account_email(self, value: Optional[pulumi.Input[
|
|
515
|
+
def service_account_email(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
331
516
|
pulumi.set(self, "service_account_email", value)
|
|
332
517
|
|
|
333
518
|
|
|
334
519
|
@pulumi.input_type
|
|
335
520
|
class _SecretBackendState:
|
|
336
521
|
def __init__(__self__, *,
|
|
337
|
-
accessor: Optional[pulumi.Input[
|
|
338
|
-
|
|
339
|
-
|
|
340
|
-
|
|
341
|
-
|
|
342
|
-
|
|
343
|
-
|
|
344
|
-
|
|
345
|
-
|
|
346
|
-
|
|
347
|
-
|
|
348
|
-
|
|
349
|
-
|
|
350
|
-
|
|
351
|
-
|
|
352
|
-
|
|
353
|
-
|
|
354
|
-
|
|
522
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
523
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
524
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
525
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
526
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
527
|
+
credentials: Optional[pulumi.Input[_builtins.str]] = None,
|
|
528
|
+
credentials_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
529
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
530
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
531
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
532
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
533
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
534
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
535
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
536
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
537
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
538
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
539
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
540
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
541
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
542
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
543
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
544
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
545
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
546
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
547
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
548
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
549
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
550
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
551
|
+
service_account_email: Optional[pulumi.Input[_builtins.str]] = None):
|
|
355
552
|
"""
|
|
356
553
|
Input properties used for looking up and filtering SecretBackend resources.
|
|
357
|
-
:param pulumi.Input[
|
|
358
|
-
:param pulumi.Input[
|
|
359
|
-
:param pulumi.Input[
|
|
360
|
-
:param pulumi.Input[
|
|
361
|
-
|
|
362
|
-
:param pulumi.Input[
|
|
363
|
-
:param pulumi.Input[
|
|
554
|
+
:param pulumi.Input[_builtins.str] accessor: The accessor of the created GCP mount.
|
|
555
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
556
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
557
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
558
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
559
|
+
:param pulumi.Input[_builtins.str] credentials: JSON-encoded credentials to use to connect to GCP
|
|
560
|
+
:param pulumi.Input[_builtins.int] credentials_wo_version: The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
561
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
562
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
563
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
564
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
364
565
|
*Available only for Vault Enterprise*.
|
|
365
|
-
:param pulumi.Input[
|
|
566
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
366
567
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
367
|
-
:param pulumi.Input[
|
|
568
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
569
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
570
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value for plugin identity
|
|
368
571
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
369
572
|
Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
370
|
-
:param pulumi.Input[
|
|
371
|
-
|
|
372
|
-
:param pulumi.Input[
|
|
373
|
-
:param pulumi.Input[
|
|
374
|
-
:param pulumi.Input[
|
|
375
|
-
|
|
376
|
-
:param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
|
|
573
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
574
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated tokens.
|
|
575
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
576
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
577
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
578
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
377
579
|
The value should not contain leading or trailing forward slashes.
|
|
378
580
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
379
581
|
*Available only for Vault Enterprise*.
|
|
380
|
-
:param pulumi.Input[
|
|
582
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
583
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
584
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
381
585
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
382
|
-
:param pulumi.Input[
|
|
586
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
587
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
383
588
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
384
589
|
*Available only for Vault Enterprise*.
|
|
385
|
-
:param pulumi.Input[
|
|
590
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
386
591
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
387
|
-
:param pulumi.Input[
|
|
592
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
388
593
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
389
594
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
390
|
-
:param pulumi.Input[
|
|
595
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
596
|
+
:param pulumi.Input[_builtins.str] service_account_email: Service Account to impersonate for plugin workload identity federation.
|
|
391
597
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
392
598
|
"""
|
|
393
599
|
if accessor is not None:
|
|
394
600
|
pulumi.set(__self__, "accessor", accessor)
|
|
601
|
+
if allowed_managed_keys is not None:
|
|
602
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
603
|
+
if allowed_response_headers is not None:
|
|
604
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
605
|
+
if audit_non_hmac_request_keys is not None:
|
|
606
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
607
|
+
if audit_non_hmac_response_keys is not None:
|
|
608
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
395
609
|
if credentials is not None:
|
|
396
610
|
pulumi.set(__self__, "credentials", credentials)
|
|
397
611
|
if credentials_wo_version is not None:
|
|
398
612
|
pulumi.set(__self__, "credentials_wo_version", credentials_wo_version)
|
|
399
613
|
if default_lease_ttl_seconds is not None:
|
|
400
614
|
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
615
|
+
if delegated_auth_accessors is not None:
|
|
616
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
401
617
|
if description is not None:
|
|
402
618
|
pulumi.set(__self__, "description", description)
|
|
403
619
|
if disable_automated_rotation is not None:
|
|
404
620
|
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
405
621
|
if disable_remount is not None:
|
|
406
622
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
623
|
+
if external_entropy_access is not None:
|
|
624
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
625
|
+
if force_no_cache is not None:
|
|
626
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
407
627
|
if identity_token_audience is not None:
|
|
408
628
|
pulumi.set(__self__, "identity_token_audience", identity_token_audience)
|
|
409
629
|
if identity_token_key is not None:
|
|
410
630
|
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
411
631
|
if identity_token_ttl is not None:
|
|
412
632
|
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
633
|
+
if listing_visibility is not None:
|
|
634
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
413
635
|
if local is not None:
|
|
414
636
|
pulumi.set(__self__, "local", local)
|
|
415
637
|
if max_lease_ttl_seconds is not None:
|
|
416
638
|
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
417
639
|
if namespace is not None:
|
|
418
640
|
pulumi.set(__self__, "namespace", namespace)
|
|
641
|
+
if options is not None:
|
|
642
|
+
pulumi.set(__self__, "options", options)
|
|
643
|
+
if passthrough_request_headers is not None:
|
|
644
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
419
645
|
if path is not None:
|
|
420
646
|
pulumi.set(__self__, "path", path)
|
|
647
|
+
if plugin_version is not None:
|
|
648
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
421
649
|
if rotation_period is not None:
|
|
422
650
|
pulumi.set(__self__, "rotation_period", rotation_period)
|
|
423
651
|
if rotation_schedule is not None:
|
|
424
652
|
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
425
653
|
if rotation_window is not None:
|
|
426
654
|
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
655
|
+
if seal_wrap is not None:
|
|
656
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
427
657
|
if service_account_email is not None:
|
|
428
658
|
pulumi.set(__self__, "service_account_email", service_account_email)
|
|
429
659
|
|
|
430
|
-
@property
|
|
660
|
+
@_builtins.property
|
|
431
661
|
@pulumi.getter
|
|
432
|
-
def accessor(self) -> Optional[pulumi.Input[
|
|
662
|
+
def accessor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
433
663
|
"""
|
|
434
664
|
The accessor of the created GCP mount.
|
|
435
665
|
"""
|
|
436
666
|
return pulumi.get(self, "accessor")
|
|
437
667
|
|
|
438
668
|
@accessor.setter
|
|
439
|
-
def accessor(self, value: Optional[pulumi.Input[
|
|
669
|
+
def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
440
670
|
pulumi.set(self, "accessor", value)
|
|
441
671
|
|
|
442
|
-
@property
|
|
672
|
+
@_builtins.property
|
|
673
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
674
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
675
|
+
"""
|
|
676
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
677
|
+
"""
|
|
678
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
679
|
+
|
|
680
|
+
@allowed_managed_keys.setter
|
|
681
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
682
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
683
|
+
|
|
684
|
+
@_builtins.property
|
|
685
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
686
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
687
|
+
"""
|
|
688
|
+
List of headers to allow and pass from the request to the plugin
|
|
689
|
+
"""
|
|
690
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
691
|
+
|
|
692
|
+
@allowed_response_headers.setter
|
|
693
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
694
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
695
|
+
|
|
696
|
+
@_builtins.property
|
|
697
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
698
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
699
|
+
"""
|
|
700
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
701
|
+
"""
|
|
702
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
703
|
+
|
|
704
|
+
@audit_non_hmac_request_keys.setter
|
|
705
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
706
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
707
|
+
|
|
708
|
+
@_builtins.property
|
|
709
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
710
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
711
|
+
"""
|
|
712
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
713
|
+
"""
|
|
714
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
715
|
+
|
|
716
|
+
@audit_non_hmac_response_keys.setter
|
|
717
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
718
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
719
|
+
|
|
720
|
+
@_builtins.property
|
|
443
721
|
@pulumi.getter
|
|
444
|
-
def credentials(self) -> Optional[pulumi.Input[
|
|
722
|
+
def credentials(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
445
723
|
"""
|
|
446
724
|
JSON-encoded credentials to use to connect to GCP
|
|
447
725
|
"""
|
|
448
726
|
return pulumi.get(self, "credentials")
|
|
449
727
|
|
|
450
728
|
@credentials.setter
|
|
451
|
-
def credentials(self, value: Optional[pulumi.Input[
|
|
729
|
+
def credentials(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
452
730
|
pulumi.set(self, "credentials", value)
|
|
453
731
|
|
|
454
|
-
@property
|
|
732
|
+
@_builtins.property
|
|
455
733
|
@pulumi.getter(name="credentialsWoVersion")
|
|
456
|
-
def credentials_wo_version(self) -> Optional[pulumi.Input[
|
|
734
|
+
def credentials_wo_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
457
735
|
"""
|
|
458
736
|
The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
459
737
|
"""
|
|
460
738
|
return pulumi.get(self, "credentials_wo_version")
|
|
461
739
|
|
|
462
740
|
@credentials_wo_version.setter
|
|
463
|
-
def credentials_wo_version(self, value: Optional[pulumi.Input[
|
|
741
|
+
def credentials_wo_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
464
742
|
pulumi.set(self, "credentials_wo_version", value)
|
|
465
743
|
|
|
466
|
-
@property
|
|
744
|
+
@_builtins.property
|
|
467
745
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
468
|
-
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[
|
|
746
|
+
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
469
747
|
"""
|
|
470
|
-
|
|
471
|
-
issued by this backend. Defaults to '0'.
|
|
748
|
+
Default lease duration for secrets in seconds
|
|
472
749
|
"""
|
|
473
750
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
474
751
|
|
|
475
752
|
@default_lease_ttl_seconds.setter
|
|
476
|
-
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[
|
|
753
|
+
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
477
754
|
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
478
755
|
|
|
479
|
-
@property
|
|
756
|
+
@_builtins.property
|
|
757
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
758
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
759
|
+
"""
|
|
760
|
+
List of headers to allow and pass from the request to the plugin
|
|
761
|
+
"""
|
|
762
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
763
|
+
|
|
764
|
+
@delegated_auth_accessors.setter
|
|
765
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
766
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
767
|
+
|
|
768
|
+
@_builtins.property
|
|
480
769
|
@pulumi.getter
|
|
481
|
-
def description(self) -> Optional[pulumi.Input[
|
|
770
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
482
771
|
"""
|
|
483
|
-
|
|
772
|
+
Human-friendly description of the mount for the backend.
|
|
484
773
|
"""
|
|
485
774
|
return pulumi.get(self, "description")
|
|
486
775
|
|
|
487
776
|
@description.setter
|
|
488
|
-
def description(self, value: Optional[pulumi.Input[
|
|
777
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
489
778
|
pulumi.set(self, "description", value)
|
|
490
779
|
|
|
491
|
-
@property
|
|
780
|
+
@_builtins.property
|
|
492
781
|
@pulumi.getter(name="disableAutomatedRotation")
|
|
493
|
-
def disable_automated_rotation(self) -> Optional[pulumi.Input[
|
|
782
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
494
783
|
"""
|
|
495
784
|
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
496
785
|
*Available only for Vault Enterprise*.
|
|
@@ -498,12 +787,12 @@ class _SecretBackendState:
|
|
|
498
787
|
return pulumi.get(self, "disable_automated_rotation")
|
|
499
788
|
|
|
500
789
|
@disable_automated_rotation.setter
|
|
501
|
-
def disable_automated_rotation(self, value: Optional[pulumi.Input[
|
|
790
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
502
791
|
pulumi.set(self, "disable_automated_rotation", value)
|
|
503
792
|
|
|
504
|
-
@property
|
|
793
|
+
@_builtins.property
|
|
505
794
|
@pulumi.getter(name="disableRemount")
|
|
506
|
-
def disable_remount(self) -> Optional[pulumi.Input[
|
|
795
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
507
796
|
"""
|
|
508
797
|
If set, opts out of mount migration on path updates.
|
|
509
798
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
@@ -511,12 +800,36 @@ class _SecretBackendState:
|
|
|
511
800
|
return pulumi.get(self, "disable_remount")
|
|
512
801
|
|
|
513
802
|
@disable_remount.setter
|
|
514
|
-
def disable_remount(self, value: Optional[pulumi.Input[
|
|
803
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
515
804
|
pulumi.set(self, "disable_remount", value)
|
|
516
805
|
|
|
517
|
-
@property
|
|
806
|
+
@_builtins.property
|
|
807
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
808
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
809
|
+
"""
|
|
810
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
811
|
+
"""
|
|
812
|
+
return pulumi.get(self, "external_entropy_access")
|
|
813
|
+
|
|
814
|
+
@external_entropy_access.setter
|
|
815
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
816
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
817
|
+
|
|
818
|
+
@_builtins.property
|
|
819
|
+
@pulumi.getter(name="forceNoCache")
|
|
820
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
821
|
+
"""
|
|
822
|
+
If set to true, disables caching.
|
|
823
|
+
"""
|
|
824
|
+
return pulumi.get(self, "force_no_cache")
|
|
825
|
+
|
|
826
|
+
@force_no_cache.setter
|
|
827
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
828
|
+
pulumi.set(self, "force_no_cache", value)
|
|
829
|
+
|
|
830
|
+
@_builtins.property
|
|
518
831
|
@pulumi.getter(name="identityTokenAudience")
|
|
519
|
-
def identity_token_audience(self) -> Optional[pulumi.Input[
|
|
832
|
+
def identity_token_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
520
833
|
"""
|
|
521
834
|
The audience claim value for plugin identity
|
|
522
835
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
@@ -525,62 +838,72 @@ class _SecretBackendState:
|
|
|
525
838
|
return pulumi.get(self, "identity_token_audience")
|
|
526
839
|
|
|
527
840
|
@identity_token_audience.setter
|
|
528
|
-
def identity_token_audience(self, value: Optional[pulumi.Input[
|
|
841
|
+
def identity_token_audience(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
529
842
|
pulumi.set(self, "identity_token_audience", value)
|
|
530
843
|
|
|
531
|
-
@property
|
|
844
|
+
@_builtins.property
|
|
532
845
|
@pulumi.getter(name="identityTokenKey")
|
|
533
|
-
def identity_token_key(self) -> Optional[pulumi.Input[
|
|
846
|
+
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
534
847
|
"""
|
|
535
|
-
The key to use for signing
|
|
536
|
-
tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
848
|
+
The key to use for signing identity tokens.
|
|
537
849
|
"""
|
|
538
850
|
return pulumi.get(self, "identity_token_key")
|
|
539
851
|
|
|
540
852
|
@identity_token_key.setter
|
|
541
|
-
def identity_token_key(self, value: Optional[pulumi.Input[
|
|
853
|
+
def identity_token_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
542
854
|
pulumi.set(self, "identity_token_key", value)
|
|
543
855
|
|
|
544
|
-
@property
|
|
856
|
+
@_builtins.property
|
|
545
857
|
@pulumi.getter(name="identityTokenTtl")
|
|
546
|
-
def identity_token_ttl(self) -> Optional[pulumi.Input[
|
|
858
|
+
def identity_token_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
547
859
|
"""
|
|
548
860
|
The TTL of generated tokens.
|
|
549
861
|
"""
|
|
550
862
|
return pulumi.get(self, "identity_token_ttl")
|
|
551
863
|
|
|
552
864
|
@identity_token_ttl.setter
|
|
553
|
-
def identity_token_ttl(self, value: Optional[pulumi.Input[
|
|
865
|
+
def identity_token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
554
866
|
pulumi.set(self, "identity_token_ttl", value)
|
|
555
867
|
|
|
556
|
-
@property
|
|
868
|
+
@_builtins.property
|
|
869
|
+
@pulumi.getter(name="listingVisibility")
|
|
870
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
871
|
+
"""
|
|
872
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
873
|
+
"""
|
|
874
|
+
return pulumi.get(self, "listing_visibility")
|
|
875
|
+
|
|
876
|
+
@listing_visibility.setter
|
|
877
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
878
|
+
pulumi.set(self, "listing_visibility", value)
|
|
879
|
+
|
|
880
|
+
@_builtins.property
|
|
557
881
|
@pulumi.getter
|
|
558
|
-
def local(self) -> Optional[pulumi.Input[
|
|
882
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
559
883
|
"""
|
|
560
|
-
|
|
884
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
561
885
|
"""
|
|
562
886
|
return pulumi.get(self, "local")
|
|
563
887
|
|
|
564
888
|
@local.setter
|
|
565
|
-
def local(self, value: Optional[pulumi.Input[
|
|
889
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
566
890
|
pulumi.set(self, "local", value)
|
|
567
891
|
|
|
568
|
-
@property
|
|
892
|
+
@_builtins.property
|
|
569
893
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
570
|
-
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[
|
|
894
|
+
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
571
895
|
"""
|
|
572
|
-
|
|
573
|
-
for credentials issued by this backend. Defaults to '0'.
|
|
896
|
+
Maximum possible lease duration for secrets in seconds
|
|
574
897
|
"""
|
|
575
898
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
576
899
|
|
|
577
900
|
@max_lease_ttl_seconds.setter
|
|
578
|
-
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[
|
|
901
|
+
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
579
902
|
pulumi.set(self, "max_lease_ttl_seconds", value)
|
|
580
903
|
|
|
581
|
-
@property
|
|
904
|
+
@_builtins.property
|
|
582
905
|
@pulumi.getter
|
|
583
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
906
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
584
907
|
"""
|
|
585
908
|
The namespace to provision the resource in.
|
|
586
909
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -590,12 +913,36 @@ class _SecretBackendState:
|
|
|
590
913
|
return pulumi.get(self, "namespace")
|
|
591
914
|
|
|
592
915
|
@namespace.setter
|
|
593
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
916
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
594
917
|
pulumi.set(self, "namespace", value)
|
|
595
918
|
|
|
596
|
-
@property
|
|
919
|
+
@_builtins.property
|
|
920
|
+
@pulumi.getter
|
|
921
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
922
|
+
"""
|
|
923
|
+
Specifies mount type specific options that are passed to the backend
|
|
924
|
+
"""
|
|
925
|
+
return pulumi.get(self, "options")
|
|
926
|
+
|
|
927
|
+
@options.setter
|
|
928
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
929
|
+
pulumi.set(self, "options", value)
|
|
930
|
+
|
|
931
|
+
@_builtins.property
|
|
932
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
933
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
934
|
+
"""
|
|
935
|
+
List of headers to allow and pass from the request to the plugin
|
|
936
|
+
"""
|
|
937
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
938
|
+
|
|
939
|
+
@passthrough_request_headers.setter
|
|
940
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
941
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
942
|
+
|
|
943
|
+
@_builtins.property
|
|
597
944
|
@pulumi.getter
|
|
598
|
-
def path(self) -> Optional[pulumi.Input[
|
|
945
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
599
946
|
"""
|
|
600
947
|
The unique path this backend should be mounted at. Must
|
|
601
948
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
@@ -603,12 +950,24 @@ class _SecretBackendState:
|
|
|
603
950
|
return pulumi.get(self, "path")
|
|
604
951
|
|
|
605
952
|
@path.setter
|
|
606
|
-
def path(self, value: Optional[pulumi.Input[
|
|
953
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
607
954
|
pulumi.set(self, "path", value)
|
|
608
955
|
|
|
609
|
-
@property
|
|
956
|
+
@_builtins.property
|
|
957
|
+
@pulumi.getter(name="pluginVersion")
|
|
958
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
959
|
+
"""
|
|
960
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
961
|
+
"""
|
|
962
|
+
return pulumi.get(self, "plugin_version")
|
|
963
|
+
|
|
964
|
+
@plugin_version.setter
|
|
965
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
966
|
+
pulumi.set(self, "plugin_version", value)
|
|
967
|
+
|
|
968
|
+
@_builtins.property
|
|
610
969
|
@pulumi.getter(name="rotationPeriod")
|
|
611
|
-
def rotation_period(self) -> Optional[pulumi.Input[
|
|
970
|
+
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
612
971
|
"""
|
|
613
972
|
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
614
973
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
@@ -617,12 +976,12 @@ class _SecretBackendState:
|
|
|
617
976
|
return pulumi.get(self, "rotation_period")
|
|
618
977
|
|
|
619
978
|
@rotation_period.setter
|
|
620
|
-
def rotation_period(self, value: Optional[pulumi.Input[
|
|
979
|
+
def rotation_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
621
980
|
pulumi.set(self, "rotation_period", value)
|
|
622
981
|
|
|
623
|
-
@property
|
|
982
|
+
@_builtins.property
|
|
624
983
|
@pulumi.getter(name="rotationSchedule")
|
|
625
|
-
def rotation_schedule(self) -> Optional[pulumi.Input[
|
|
984
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
626
985
|
"""
|
|
627
986
|
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
628
987
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
@@ -630,12 +989,12 @@ class _SecretBackendState:
|
|
|
630
989
|
return pulumi.get(self, "rotation_schedule")
|
|
631
990
|
|
|
632
991
|
@rotation_schedule.setter
|
|
633
|
-
def rotation_schedule(self, value: Optional[pulumi.Input[
|
|
992
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
634
993
|
pulumi.set(self, "rotation_schedule", value)
|
|
635
994
|
|
|
636
|
-
@property
|
|
995
|
+
@_builtins.property
|
|
637
996
|
@pulumi.getter(name="rotationWindow")
|
|
638
|
-
def rotation_window(self) -> Optional[pulumi.Input[
|
|
997
|
+
def rotation_window(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
639
998
|
"""
|
|
640
999
|
The maximum amount of time in seconds allowed to complete
|
|
641
1000
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
@@ -644,12 +1003,24 @@ class _SecretBackendState:
|
|
|
644
1003
|
return pulumi.get(self, "rotation_window")
|
|
645
1004
|
|
|
646
1005
|
@rotation_window.setter
|
|
647
|
-
def rotation_window(self, value: Optional[pulumi.Input[
|
|
1006
|
+
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
648
1007
|
pulumi.set(self, "rotation_window", value)
|
|
649
1008
|
|
|
650
|
-
@property
|
|
1009
|
+
@_builtins.property
|
|
1010
|
+
@pulumi.getter(name="sealWrap")
|
|
1011
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1012
|
+
"""
|
|
1013
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1014
|
+
"""
|
|
1015
|
+
return pulumi.get(self, "seal_wrap")
|
|
1016
|
+
|
|
1017
|
+
@seal_wrap.setter
|
|
1018
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1019
|
+
pulumi.set(self, "seal_wrap", value)
|
|
1020
|
+
|
|
1021
|
+
@_builtins.property
|
|
651
1022
|
@pulumi.getter(name="serviceAccountEmail")
|
|
652
|
-
def service_account_email(self) -> Optional[pulumi.Input[
|
|
1023
|
+
def service_account_email(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
653
1024
|
"""
|
|
654
1025
|
Service Account to impersonate for plugin workload identity federation.
|
|
655
1026
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
@@ -657,7 +1028,7 @@ class _SecretBackendState:
|
|
|
657
1028
|
return pulumi.get(self, "service_account_email")
|
|
658
1029
|
|
|
659
1030
|
@service_account_email.setter
|
|
660
|
-
def service_account_email(self, value: Optional[pulumi.Input[
|
|
1031
|
+
def service_account_email(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
661
1032
|
pulumi.set(self, "service_account_email", value)
|
|
662
1033
|
|
|
663
1034
|
|
|
@@ -667,23 +1038,35 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
667
1038
|
def __init__(__self__,
|
|
668
1039
|
resource_name: str,
|
|
669
1040
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
670
|
-
|
|
671
|
-
|
|
672
|
-
|
|
673
|
-
|
|
674
|
-
|
|
675
|
-
|
|
676
|
-
|
|
677
|
-
|
|
678
|
-
|
|
679
|
-
|
|
680
|
-
|
|
681
|
-
|
|
682
|
-
|
|
683
|
-
|
|
684
|
-
|
|
685
|
-
|
|
686
|
-
|
|
1041
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1042
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1043
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1044
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1045
|
+
credentials: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1046
|
+
credentials_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1047
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1048
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1049
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1050
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1051
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1052
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1053
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1054
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1055
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1056
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1057
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1058
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1059
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1060
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1061
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1062
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1063
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1064
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1065
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1066
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1067
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1068
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1069
|
+
service_account_email: Optional[pulumi.Input[_builtins.str]] = None,
|
|
687
1070
|
__props__=None):
|
|
688
1071
|
"""
|
|
689
1072
|
## Example Usage
|
|
@@ -722,39 +1105,48 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
722
1105
|
|
|
723
1106
|
:param str resource_name: The name of the resource.
|
|
724
1107
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
725
|
-
:param pulumi.Input[
|
|
726
|
-
:param pulumi.Input[
|
|
727
|
-
:param pulumi.Input[
|
|
728
|
-
|
|
729
|
-
:param pulumi.Input[
|
|
730
|
-
:param pulumi.Input[
|
|
1108
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1109
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1110
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1111
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1112
|
+
:param pulumi.Input[_builtins.str] credentials: JSON-encoded credentials to use to connect to GCP
|
|
1113
|
+
:param pulumi.Input[_builtins.int] credentials_wo_version: The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
1114
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
1115
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1116
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
1117
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
731
1118
|
*Available only for Vault Enterprise*.
|
|
732
|
-
:param pulumi.Input[
|
|
1119
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
733
1120
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
734
|
-
:param pulumi.Input[
|
|
1121
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1122
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
1123
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value for plugin identity
|
|
735
1124
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
736
1125
|
Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
737
|
-
:param pulumi.Input[
|
|
738
|
-
|
|
739
|
-
:param pulumi.Input[
|
|
740
|
-
:param pulumi.Input[
|
|
741
|
-
:param pulumi.Input[
|
|
742
|
-
|
|
743
|
-
:param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
|
|
1126
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
1127
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated tokens.
|
|
1128
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1129
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1130
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
1131
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
744
1132
|
The value should not contain leading or trailing forward slashes.
|
|
745
1133
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
746
1134
|
*Available only for Vault Enterprise*.
|
|
747
|
-
:param pulumi.Input[
|
|
1135
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1136
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
1137
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
748
1138
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
749
|
-
:param pulumi.Input[
|
|
1139
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1140
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
750
1141
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
751
1142
|
*Available only for Vault Enterprise*.
|
|
752
|
-
:param pulumi.Input[
|
|
1143
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
753
1144
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
754
|
-
:param pulumi.Input[
|
|
1145
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
755
1146
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
756
1147
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
757
|
-
:param pulumi.Input[
|
|
1148
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1149
|
+
:param pulumi.Input[_builtins.str] service_account_email: Service Account to impersonate for plugin workload identity federation.
|
|
758
1150
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
759
1151
|
"""
|
|
760
1152
|
...
|
|
@@ -813,23 +1205,35 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
813
1205
|
def _internal_init(__self__,
|
|
814
1206
|
resource_name: str,
|
|
815
1207
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
816
|
-
|
|
817
|
-
|
|
818
|
-
|
|
819
|
-
|
|
820
|
-
|
|
821
|
-
|
|
822
|
-
|
|
823
|
-
|
|
824
|
-
|
|
825
|
-
|
|
826
|
-
|
|
827
|
-
|
|
828
|
-
|
|
829
|
-
|
|
830
|
-
|
|
831
|
-
|
|
832
|
-
|
|
1208
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1209
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1210
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1211
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1212
|
+
credentials: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1213
|
+
credentials_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1214
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1215
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1216
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1217
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1218
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1219
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1220
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1221
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1222
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1223
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1224
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1225
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1226
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1227
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1228
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1229
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1230
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1231
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1232
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1233
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1234
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1235
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1236
|
+
service_account_email: Optional[pulumi.Input[_builtins.str]] = None,
|
|
833
1237
|
__props__=None):
|
|
834
1238
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
835
1239
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -839,22 +1243,34 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
839
1243
|
raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
|
|
840
1244
|
__props__ = SecretBackendArgs.__new__(SecretBackendArgs)
|
|
841
1245
|
|
|
1246
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1247
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1248
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1249
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
842
1250
|
__props__.__dict__["credentials"] = None if credentials is None else pulumi.Output.secret(credentials)
|
|
843
1251
|
__props__.__dict__["credentials_wo_version"] = credentials_wo_version
|
|
844
1252
|
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
1253
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
845
1254
|
__props__.__dict__["description"] = description
|
|
846
1255
|
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
847
1256
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1257
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1258
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
848
1259
|
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
849
1260
|
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
850
1261
|
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
1262
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
851
1263
|
__props__.__dict__["local"] = local
|
|
852
1264
|
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
853
1265
|
__props__.__dict__["namespace"] = namespace
|
|
1266
|
+
__props__.__dict__["options"] = options
|
|
1267
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
854
1268
|
__props__.__dict__["path"] = path
|
|
1269
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
855
1270
|
__props__.__dict__["rotation_period"] = rotation_period
|
|
856
1271
|
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
857
1272
|
__props__.__dict__["rotation_window"] = rotation_window
|
|
1273
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
858
1274
|
__props__.__dict__["service_account_email"] = service_account_email
|
|
859
1275
|
__props__.__dict__["accessor"] = None
|
|
860
1276
|
secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["credentials"])
|
|
@@ -869,24 +1285,36 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
869
1285
|
def get(resource_name: str,
|
|
870
1286
|
id: pulumi.Input[str],
|
|
871
1287
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
872
|
-
accessor: Optional[pulumi.Input[
|
|
873
|
-
|
|
874
|
-
|
|
875
|
-
|
|
876
|
-
|
|
877
|
-
|
|
878
|
-
|
|
879
|
-
|
|
880
|
-
|
|
881
|
-
|
|
882
|
-
|
|
883
|
-
|
|
884
|
-
|
|
885
|
-
|
|
886
|
-
|
|
887
|
-
|
|
888
|
-
|
|
889
|
-
|
|
1288
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1289
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1290
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1291
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1292
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1293
|
+
credentials: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1294
|
+
credentials_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1295
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1296
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1297
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1298
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1299
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1300
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1301
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1302
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1303
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1304
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1305
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1306
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1307
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1308
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1309
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1310
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1311
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1312
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1313
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1314
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1315
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1316
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1317
|
+
service_account_email: Optional[pulumi.Input[_builtins.str]] = None) -> 'SecretBackend':
|
|
890
1318
|
"""
|
|
891
1319
|
Get an existing SecretBackend resource's state with the given name, id, and optional extra
|
|
892
1320
|
properties used to qualify the lookup.
|
|
@@ -894,40 +1322,49 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
894
1322
|
:param str resource_name: The unique name of the resulting resource.
|
|
895
1323
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
896
1324
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
897
|
-
:param pulumi.Input[
|
|
898
|
-
:param pulumi.Input[
|
|
899
|
-
:param pulumi.Input[
|
|
900
|
-
:param pulumi.Input[
|
|
901
|
-
|
|
902
|
-
:param pulumi.Input[
|
|
903
|
-
:param pulumi.Input[
|
|
1325
|
+
:param pulumi.Input[_builtins.str] accessor: The accessor of the created GCP mount.
|
|
1326
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1327
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1328
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1329
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1330
|
+
:param pulumi.Input[_builtins.str] credentials: JSON-encoded credentials to use to connect to GCP
|
|
1331
|
+
:param pulumi.Input[_builtins.int] credentials_wo_version: The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
1332
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
1333
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1334
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
1335
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
904
1336
|
*Available only for Vault Enterprise*.
|
|
905
|
-
:param pulumi.Input[
|
|
1337
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
906
1338
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
907
|
-
:param pulumi.Input[
|
|
1339
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1340
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
1341
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value for plugin identity
|
|
908
1342
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
909
1343
|
Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
910
|
-
:param pulumi.Input[
|
|
911
|
-
|
|
912
|
-
:param pulumi.Input[
|
|
913
|
-
:param pulumi.Input[
|
|
914
|
-
:param pulumi.Input[
|
|
915
|
-
|
|
916
|
-
:param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
|
|
1344
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
1345
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated tokens.
|
|
1346
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1347
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1348
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
1349
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
917
1350
|
The value should not contain leading or trailing forward slashes.
|
|
918
1351
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
919
1352
|
*Available only for Vault Enterprise*.
|
|
920
|
-
:param pulumi.Input[
|
|
1353
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1354
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
1355
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
921
1356
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
922
|
-
:param pulumi.Input[
|
|
1357
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1358
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
923
1359
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
924
1360
|
*Available only for Vault Enterprise*.
|
|
925
|
-
:param pulumi.Input[
|
|
1361
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
926
1362
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
927
|
-
:param pulumi.Input[
|
|
1363
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
928
1364
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
929
1365
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
930
|
-
:param pulumi.Input[
|
|
1366
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1367
|
+
:param pulumi.Input[_builtins.str] service_account_email: Service Account to impersonate for plugin workload identity federation.
|
|
931
1368
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
932
1369
|
"""
|
|
933
1370
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
@@ -935,87 +1372,154 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
935
1372
|
__props__ = _SecretBackendState.__new__(_SecretBackendState)
|
|
936
1373
|
|
|
937
1374
|
__props__.__dict__["accessor"] = accessor
|
|
1375
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1376
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1377
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1378
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
938
1379
|
__props__.__dict__["credentials"] = credentials
|
|
939
1380
|
__props__.__dict__["credentials_wo_version"] = credentials_wo_version
|
|
940
1381
|
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
1382
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
941
1383
|
__props__.__dict__["description"] = description
|
|
942
1384
|
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
943
1385
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1386
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1387
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
944
1388
|
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
945
1389
|
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
946
1390
|
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
1391
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
947
1392
|
__props__.__dict__["local"] = local
|
|
948
1393
|
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
949
1394
|
__props__.__dict__["namespace"] = namespace
|
|
1395
|
+
__props__.__dict__["options"] = options
|
|
1396
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
950
1397
|
__props__.__dict__["path"] = path
|
|
1398
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
951
1399
|
__props__.__dict__["rotation_period"] = rotation_period
|
|
952
1400
|
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
953
1401
|
__props__.__dict__["rotation_window"] = rotation_window
|
|
1402
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
954
1403
|
__props__.__dict__["service_account_email"] = service_account_email
|
|
955
1404
|
return SecretBackend(resource_name, opts=opts, __props__=__props__)
|
|
956
1405
|
|
|
957
|
-
@property
|
|
1406
|
+
@_builtins.property
|
|
958
1407
|
@pulumi.getter
|
|
959
|
-
def accessor(self) -> pulumi.Output[
|
|
1408
|
+
def accessor(self) -> pulumi.Output[_builtins.str]:
|
|
960
1409
|
"""
|
|
961
1410
|
The accessor of the created GCP mount.
|
|
962
1411
|
"""
|
|
963
1412
|
return pulumi.get(self, "accessor")
|
|
964
1413
|
|
|
965
|
-
@property
|
|
1414
|
+
@_builtins.property
|
|
1415
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
1416
|
+
def allowed_managed_keys(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1417
|
+
"""
|
|
1418
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
1419
|
+
"""
|
|
1420
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
1421
|
+
|
|
1422
|
+
@_builtins.property
|
|
1423
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
1424
|
+
def allowed_response_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1425
|
+
"""
|
|
1426
|
+
List of headers to allow and pass from the request to the plugin
|
|
1427
|
+
"""
|
|
1428
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
1429
|
+
|
|
1430
|
+
@_builtins.property
|
|
1431
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
1432
|
+
def audit_non_hmac_request_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1433
|
+
"""
|
|
1434
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1435
|
+
"""
|
|
1436
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
1437
|
+
|
|
1438
|
+
@_builtins.property
|
|
1439
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
1440
|
+
def audit_non_hmac_response_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1441
|
+
"""
|
|
1442
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1443
|
+
"""
|
|
1444
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
1445
|
+
|
|
1446
|
+
@_builtins.property
|
|
966
1447
|
@pulumi.getter
|
|
967
|
-
def credentials(self) -> pulumi.Output[Optional[
|
|
1448
|
+
def credentials(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
968
1449
|
"""
|
|
969
1450
|
JSON-encoded credentials to use to connect to GCP
|
|
970
1451
|
"""
|
|
971
1452
|
return pulumi.get(self, "credentials")
|
|
972
1453
|
|
|
973
|
-
@property
|
|
1454
|
+
@_builtins.property
|
|
974
1455
|
@pulumi.getter(name="credentialsWoVersion")
|
|
975
|
-
def credentials_wo_version(self) -> pulumi.Output[Optional[
|
|
1456
|
+
def credentials_wo_version(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
976
1457
|
"""
|
|
977
1458
|
The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
978
1459
|
"""
|
|
979
1460
|
return pulumi.get(self, "credentials_wo_version")
|
|
980
1461
|
|
|
981
|
-
@property
|
|
1462
|
+
@_builtins.property
|
|
982
1463
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
983
|
-
def default_lease_ttl_seconds(self) -> pulumi.Output[Optional[
|
|
1464
|
+
def default_lease_ttl_seconds(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
984
1465
|
"""
|
|
985
|
-
|
|
986
|
-
issued by this backend. Defaults to '0'.
|
|
1466
|
+
Default lease duration for secrets in seconds
|
|
987
1467
|
"""
|
|
988
1468
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
989
1469
|
|
|
990
|
-
@property
|
|
1470
|
+
@_builtins.property
|
|
1471
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
1472
|
+
def delegated_auth_accessors(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1473
|
+
"""
|
|
1474
|
+
List of headers to allow and pass from the request to the plugin
|
|
1475
|
+
"""
|
|
1476
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
1477
|
+
|
|
1478
|
+
@_builtins.property
|
|
991
1479
|
@pulumi.getter
|
|
992
|
-
def description(self) -> pulumi.Output[Optional[
|
|
1480
|
+
def description(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
993
1481
|
"""
|
|
994
|
-
|
|
1482
|
+
Human-friendly description of the mount for the backend.
|
|
995
1483
|
"""
|
|
996
1484
|
return pulumi.get(self, "description")
|
|
997
1485
|
|
|
998
|
-
@property
|
|
1486
|
+
@_builtins.property
|
|
999
1487
|
@pulumi.getter(name="disableAutomatedRotation")
|
|
1000
|
-
def disable_automated_rotation(self) -> pulumi.Output[Optional[
|
|
1488
|
+
def disable_automated_rotation(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1001
1489
|
"""
|
|
1002
1490
|
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1003
1491
|
*Available only for Vault Enterprise*.
|
|
1004
1492
|
"""
|
|
1005
1493
|
return pulumi.get(self, "disable_automated_rotation")
|
|
1006
1494
|
|
|
1007
|
-
@property
|
|
1495
|
+
@_builtins.property
|
|
1008
1496
|
@pulumi.getter(name="disableRemount")
|
|
1009
|
-
def disable_remount(self) -> pulumi.Output[Optional[
|
|
1497
|
+
def disable_remount(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1010
1498
|
"""
|
|
1011
1499
|
If set, opts out of mount migration on path updates.
|
|
1012
1500
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1013
1501
|
"""
|
|
1014
1502
|
return pulumi.get(self, "disable_remount")
|
|
1015
1503
|
|
|
1016
|
-
@property
|
|
1504
|
+
@_builtins.property
|
|
1505
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
1506
|
+
def external_entropy_access(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1507
|
+
"""
|
|
1508
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
1509
|
+
"""
|
|
1510
|
+
return pulumi.get(self, "external_entropy_access")
|
|
1511
|
+
|
|
1512
|
+
@_builtins.property
|
|
1513
|
+
@pulumi.getter(name="forceNoCache")
|
|
1514
|
+
def force_no_cache(self) -> pulumi.Output[_builtins.bool]:
|
|
1515
|
+
"""
|
|
1516
|
+
If set to true, disables caching.
|
|
1517
|
+
"""
|
|
1518
|
+
return pulumi.get(self, "force_no_cache")
|
|
1519
|
+
|
|
1520
|
+
@_builtins.property
|
|
1017
1521
|
@pulumi.getter(name="identityTokenAudience")
|
|
1018
|
-
def identity_token_audience(self) -> pulumi.Output[Optional[
|
|
1522
|
+
def identity_token_audience(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1019
1523
|
"""
|
|
1020
1524
|
The audience claim value for plugin identity
|
|
1021
1525
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
@@ -1023,43 +1527,49 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1023
1527
|
"""
|
|
1024
1528
|
return pulumi.get(self, "identity_token_audience")
|
|
1025
1529
|
|
|
1026
|
-
@property
|
|
1530
|
+
@_builtins.property
|
|
1027
1531
|
@pulumi.getter(name="identityTokenKey")
|
|
1028
|
-
def identity_token_key(self) -> pulumi.Output[Optional[
|
|
1532
|
+
def identity_token_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1029
1533
|
"""
|
|
1030
|
-
The key to use for signing
|
|
1031
|
-
tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
1534
|
+
The key to use for signing identity tokens.
|
|
1032
1535
|
"""
|
|
1033
1536
|
return pulumi.get(self, "identity_token_key")
|
|
1034
1537
|
|
|
1035
|
-
@property
|
|
1538
|
+
@_builtins.property
|
|
1036
1539
|
@pulumi.getter(name="identityTokenTtl")
|
|
1037
|
-
def identity_token_ttl(self) -> pulumi.Output[Optional[
|
|
1540
|
+
def identity_token_ttl(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1038
1541
|
"""
|
|
1039
1542
|
The TTL of generated tokens.
|
|
1040
1543
|
"""
|
|
1041
1544
|
return pulumi.get(self, "identity_token_ttl")
|
|
1042
1545
|
|
|
1043
|
-
@property
|
|
1546
|
+
@_builtins.property
|
|
1547
|
+
@pulumi.getter(name="listingVisibility")
|
|
1548
|
+
def listing_visibility(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1549
|
+
"""
|
|
1550
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1551
|
+
"""
|
|
1552
|
+
return pulumi.get(self, "listing_visibility")
|
|
1553
|
+
|
|
1554
|
+
@_builtins.property
|
|
1044
1555
|
@pulumi.getter
|
|
1045
|
-
def local(self) -> pulumi.Output[Optional[
|
|
1556
|
+
def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1046
1557
|
"""
|
|
1047
|
-
|
|
1558
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1048
1559
|
"""
|
|
1049
1560
|
return pulumi.get(self, "local")
|
|
1050
1561
|
|
|
1051
|
-
@property
|
|
1562
|
+
@_builtins.property
|
|
1052
1563
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
1053
|
-
def max_lease_ttl_seconds(self) -> pulumi.Output[Optional[
|
|
1564
|
+
def max_lease_ttl_seconds(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1054
1565
|
"""
|
|
1055
|
-
|
|
1056
|
-
for credentials issued by this backend. Defaults to '0'.
|
|
1566
|
+
Maximum possible lease duration for secrets in seconds
|
|
1057
1567
|
"""
|
|
1058
1568
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
1059
1569
|
|
|
1060
|
-
@property
|
|
1570
|
+
@_builtins.property
|
|
1061
1571
|
@pulumi.getter
|
|
1062
|
-
def namespace(self) -> pulumi.Output[Optional[
|
|
1572
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1063
1573
|
"""
|
|
1064
1574
|
The namespace to provision the resource in.
|
|
1065
1575
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -1068,18 +1578,42 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1068
1578
|
"""
|
|
1069
1579
|
return pulumi.get(self, "namespace")
|
|
1070
1580
|
|
|
1071
|
-
@property
|
|
1581
|
+
@_builtins.property
|
|
1582
|
+
@pulumi.getter
|
|
1583
|
+
def options(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1584
|
+
"""
|
|
1585
|
+
Specifies mount type specific options that are passed to the backend
|
|
1586
|
+
"""
|
|
1587
|
+
return pulumi.get(self, "options")
|
|
1588
|
+
|
|
1589
|
+
@_builtins.property
|
|
1590
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
1591
|
+
def passthrough_request_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1592
|
+
"""
|
|
1593
|
+
List of headers to allow and pass from the request to the plugin
|
|
1594
|
+
"""
|
|
1595
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
1596
|
+
|
|
1597
|
+
@_builtins.property
|
|
1072
1598
|
@pulumi.getter
|
|
1073
|
-
def path(self) -> pulumi.Output[Optional[
|
|
1599
|
+
def path(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1074
1600
|
"""
|
|
1075
1601
|
The unique path this backend should be mounted at. Must
|
|
1076
1602
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
1077
1603
|
"""
|
|
1078
1604
|
return pulumi.get(self, "path")
|
|
1079
1605
|
|
|
1080
|
-
@property
|
|
1606
|
+
@_builtins.property
|
|
1607
|
+
@pulumi.getter(name="pluginVersion")
|
|
1608
|
+
def plugin_version(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1609
|
+
"""
|
|
1610
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1611
|
+
"""
|
|
1612
|
+
return pulumi.get(self, "plugin_version")
|
|
1613
|
+
|
|
1614
|
+
@_builtins.property
|
|
1081
1615
|
@pulumi.getter(name="rotationPeriod")
|
|
1082
|
-
def rotation_period(self) -> pulumi.Output[Optional[
|
|
1616
|
+
def rotation_period(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1083
1617
|
"""
|
|
1084
1618
|
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1085
1619
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
@@ -1087,18 +1621,18 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1087
1621
|
"""
|
|
1088
1622
|
return pulumi.get(self, "rotation_period")
|
|
1089
1623
|
|
|
1090
|
-
@property
|
|
1624
|
+
@_builtins.property
|
|
1091
1625
|
@pulumi.getter(name="rotationSchedule")
|
|
1092
|
-
def rotation_schedule(self) -> pulumi.Output[Optional[
|
|
1626
|
+
def rotation_schedule(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1093
1627
|
"""
|
|
1094
1628
|
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1095
1629
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
1096
1630
|
"""
|
|
1097
1631
|
return pulumi.get(self, "rotation_schedule")
|
|
1098
1632
|
|
|
1099
|
-
@property
|
|
1633
|
+
@_builtins.property
|
|
1100
1634
|
@pulumi.getter(name="rotationWindow")
|
|
1101
|
-
def rotation_window(self) -> pulumi.Output[Optional[
|
|
1635
|
+
def rotation_window(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1102
1636
|
"""
|
|
1103
1637
|
The maximum amount of time in seconds allowed to complete
|
|
1104
1638
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
@@ -1106,9 +1640,17 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1106
1640
|
"""
|
|
1107
1641
|
return pulumi.get(self, "rotation_window")
|
|
1108
1642
|
|
|
1109
|
-
@property
|
|
1643
|
+
@_builtins.property
|
|
1644
|
+
@pulumi.getter(name="sealWrap")
|
|
1645
|
+
def seal_wrap(self) -> pulumi.Output[_builtins.bool]:
|
|
1646
|
+
"""
|
|
1647
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1648
|
+
"""
|
|
1649
|
+
return pulumi.get(self, "seal_wrap")
|
|
1650
|
+
|
|
1651
|
+
@_builtins.property
|
|
1110
1652
|
@pulumi.getter(name="serviceAccountEmail")
|
|
1111
|
-
def service_account_email(self) -> pulumi.Output[Optional[
|
|
1653
|
+
def service_account_email(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1112
1654
|
"""
|
|
1113
1655
|
Service Account to impersonate for plugin workload identity federation.
|
|
1114
1656
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|