pulumi-vault 7.2.0a1753339763__py3-none-any.whl → 7.2.0a1753398491__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +1 -1
- pulumi_vault/_inputs.py +672 -673
- pulumi_vault/ad/__init__.py +1 -1
- pulumi_vault/ad/get_access_credentials.py +27 -28
- pulumi_vault/ad/secret_backend.py +579 -580
- pulumi_vault/ad/secret_library.py +120 -121
- pulumi_vault/ad/secret_role.py +104 -105
- pulumi_vault/alicloud/__init__.py +1 -1
- pulumi_vault/alicloud/auth_backend_role.py +222 -223
- pulumi_vault/approle/__init__.py +1 -1
- pulumi_vault/approle/auth_backend_login.py +138 -139
- pulumi_vault/approle/auth_backend_role.py +292 -293
- pulumi_vault/approle/auth_backend_role_secret_id.py +202 -203
- pulumi_vault/approle/get_auth_backend_role_id.py +23 -24
- pulumi_vault/audit.py +103 -104
- pulumi_vault/audit_request_header.py +52 -53
- pulumi_vault/auth_backend.py +132 -133
- pulumi_vault/aws/__init__.py +1 -1
- pulumi_vault/aws/auth_backend_cert.py +86 -87
- pulumi_vault/aws/auth_backend_client.py +307 -308
- pulumi_vault/aws/auth_backend_config_identity.py +103 -104
- pulumi_vault/aws/auth_backend_identity_whitelist.py +69 -70
- pulumi_vault/aws/auth_backend_login.py +258 -259
- pulumi_vault/aws/auth_backend_role.py +486 -487
- pulumi_vault/aws/auth_backend_role_tag.py +155 -156
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +69 -70
- pulumi_vault/aws/auth_backend_sts_role.py +86 -87
- pulumi_vault/aws/get_access_credentials.py +59 -60
- pulumi_vault/aws/get_static_access_credentials.py +19 -20
- pulumi_vault/aws/secret_backend.py +409 -410
- pulumi_vault/aws/secret_backend_role.py +256 -257
- pulumi_vault/aws/secret_backend_static_role.py +137 -138
- pulumi_vault/azure/__init__.py +1 -1
- pulumi_vault/azure/_inputs.py +26 -27
- pulumi_vault/azure/auth_backend_config.py +222 -223
- pulumi_vault/azure/auth_backend_role.py +307 -308
- pulumi_vault/azure/backend.py +273 -274
- pulumi_vault/azure/backend_role.py +194 -195
- pulumi_vault/azure/get_access_credentials.py +75 -76
- pulumi_vault/azure/outputs.py +16 -17
- pulumi_vault/cert_auth_backend_role.py +443 -444
- pulumi_vault/config/__init__.py +1 -1
- pulumi_vault/config/__init__.pyi +1 -2
- pulumi_vault/config/_inputs.py +13 -14
- pulumi_vault/config/outputs.py +380 -381
- pulumi_vault/config/ui_custom_message.py +140 -141
- pulumi_vault/config/vars.py +31 -32
- pulumi_vault/consul/__init__.py +1 -1
- pulumi_vault/consul/secret_backend.py +239 -240
- pulumi_vault/consul/secret_backend_role.py +222 -223
- pulumi_vault/database/__init__.py +1 -1
- pulumi_vault/database/_inputs.py +3167 -3168
- pulumi_vault/database/outputs.py +2123 -2124
- pulumi_vault/database/secret_backend_connection.py +259 -260
- pulumi_vault/database/secret_backend_role.py +205 -206
- pulumi_vault/database/secret_backend_static_role.py +218 -219
- pulumi_vault/database/secrets_mount.py +379 -380
- pulumi_vault/egp_policy.py +86 -87
- pulumi_vault/gcp/__init__.py +1 -1
- pulumi_vault/gcp/_inputs.py +98 -99
- pulumi_vault/gcp/auth_backend.py +322 -323
- pulumi_vault/gcp/auth_backend_role.py +347 -348
- pulumi_vault/gcp/get_auth_backend_role.py +91 -92
- pulumi_vault/gcp/outputs.py +66 -67
- pulumi_vault/gcp/secret_backend.py +299 -300
- pulumi_vault/gcp/secret_impersonated_account.py +112 -113
- pulumi_vault/gcp/secret_roleset.py +115 -116
- pulumi_vault/gcp/secret_static_account.py +115 -116
- pulumi_vault/generic/__init__.py +1 -1
- pulumi_vault/generic/endpoint.py +138 -139
- pulumi_vault/generic/get_secret.py +39 -40
- pulumi_vault/generic/secret.py +95 -96
- pulumi_vault/get_auth_backend.py +29 -30
- pulumi_vault/get_auth_backends.py +19 -20
- pulumi_vault/get_namespace.py +21 -22
- pulumi_vault/get_namespaces.py +19 -20
- pulumi_vault/get_nomad_access_token.py +25 -26
- pulumi_vault/get_policy_document.py +10 -11
- pulumi_vault/get_raft_autopilot_state.py +31 -32
- pulumi_vault/github/__init__.py +1 -1
- pulumi_vault/github/_inputs.py +50 -51
- pulumi_vault/github/auth_backend.py +285 -286
- pulumi_vault/github/outputs.py +34 -35
- pulumi_vault/github/team.py +69 -70
- pulumi_vault/github/user.py +69 -70
- pulumi_vault/identity/__init__.py +1 -1
- pulumi_vault/identity/entity.py +103 -104
- pulumi_vault/identity/entity_alias.py +86 -87
- pulumi_vault/identity/entity_policies.py +78 -79
- pulumi_vault/identity/get_entity.py +62 -63
- pulumi_vault/identity/get_group.py +75 -76
- pulumi_vault/identity/get_oidc_client_creds.py +19 -20
- pulumi_vault/identity/get_oidc_openid_config.py +39 -40
- pulumi_vault/identity/get_oidc_public_keys.py +17 -18
- pulumi_vault/identity/group.py +171 -172
- pulumi_vault/identity/group_alias.py +69 -70
- pulumi_vault/identity/group_member_entity_ids.py +69 -70
- pulumi_vault/identity/group_member_group_ids.py +69 -70
- pulumi_vault/identity/group_policies.py +78 -79
- pulumi_vault/identity/mfa_duo.py +183 -184
- pulumi_vault/identity/mfa_login_enforcement.py +147 -148
- pulumi_vault/identity/mfa_okta.py +166 -167
- pulumi_vault/identity/mfa_pingid.py +160 -161
- pulumi_vault/identity/mfa_totp.py +217 -218
- pulumi_vault/identity/oidc.py +35 -36
- pulumi_vault/identity/oidc_assignment.py +69 -70
- pulumi_vault/identity/oidc_client.py +155 -156
- pulumi_vault/identity/oidc_key.py +103 -104
- pulumi_vault/identity/oidc_key_allowed_client_id.py +52 -53
- pulumi_vault/identity/oidc_provider.py +112 -113
- pulumi_vault/identity/oidc_role.py +103 -104
- pulumi_vault/identity/oidc_scope.py +69 -70
- pulumi_vault/identity/outputs.py +42 -43
- pulumi_vault/jwt/__init__.py +1 -1
- pulumi_vault/jwt/_inputs.py +50 -51
- pulumi_vault/jwt/auth_backend.py +353 -354
- pulumi_vault/jwt/auth_backend_role.py +494 -495
- pulumi_vault/jwt/outputs.py +34 -35
- pulumi_vault/kmip/__init__.py +1 -1
- pulumi_vault/kmip/secret_backend.py +222 -223
- pulumi_vault/kmip/secret_role.py +358 -359
- pulumi_vault/kmip/secret_scope.py +69 -70
- pulumi_vault/kubernetes/__init__.py +1 -1
- pulumi_vault/kubernetes/auth_backend_config.py +171 -172
- pulumi_vault/kubernetes/auth_backend_role.py +273 -274
- pulumi_vault/kubernetes/get_auth_backend_config.py +57 -58
- pulumi_vault/kubernetes/get_auth_backend_role.py +87 -88
- pulumi_vault/kubernetes/get_service_account_token.py +51 -52
- pulumi_vault/kubernetes/secret_backend.py +384 -385
- pulumi_vault/kubernetes/secret_backend_role.py +239 -240
- pulumi_vault/kv/__init__.py +1 -1
- pulumi_vault/kv/_inputs.py +25 -26
- pulumi_vault/kv/get_secret.py +25 -26
- pulumi_vault/kv/get_secret_subkeys_v2.py +39 -40
- pulumi_vault/kv/get_secret_v2.py +41 -42
- pulumi_vault/kv/get_secrets_list.py +17 -18
- pulumi_vault/kv/get_secrets_list_v2.py +25 -26
- pulumi_vault/kv/outputs.py +17 -18
- pulumi_vault/kv/secret.py +61 -62
- pulumi_vault/kv/secret_backend_v2.py +86 -87
- pulumi_vault/kv/secret_v2.py +184 -185
- pulumi_vault/ldap/__init__.py +1 -1
- pulumi_vault/ldap/auth_backend.py +716 -717
- pulumi_vault/ldap/auth_backend_group.py +69 -70
- pulumi_vault/ldap/auth_backend_user.py +86 -87
- pulumi_vault/ldap/get_dynamic_credentials.py +27 -28
- pulumi_vault/ldap/get_static_credentials.py +29 -30
- pulumi_vault/ldap/secret_backend.py +673 -674
- pulumi_vault/ldap/secret_backend_dynamic_role.py +154 -155
- pulumi_vault/ldap/secret_backend_library_set.py +120 -121
- pulumi_vault/ldap/secret_backend_static_role.py +120 -121
- pulumi_vault/managed/__init__.py +1 -1
- pulumi_vault/managed/_inputs.py +274 -275
- pulumi_vault/managed/keys.py +27 -28
- pulumi_vault/managed/outputs.py +184 -185
- pulumi_vault/mfa_duo.py +137 -138
- pulumi_vault/mfa_okta.py +137 -138
- pulumi_vault/mfa_pingid.py +149 -150
- pulumi_vault/mfa_totp.py +154 -155
- pulumi_vault/mongodbatlas/__init__.py +1 -1
- pulumi_vault/mongodbatlas/secret_backend.py +78 -79
- pulumi_vault/mongodbatlas/secret_role.py +188 -189
- pulumi_vault/mount.py +333 -334
- pulumi_vault/namespace.py +78 -79
- pulumi_vault/nomad_secret_backend.py +256 -257
- pulumi_vault/nomad_secret_role.py +103 -104
- pulumi_vault/okta/__init__.py +1 -1
- pulumi_vault/okta/_inputs.py +31 -32
- pulumi_vault/okta/auth_backend.py +305 -306
- pulumi_vault/okta/auth_backend_group.py +69 -70
- pulumi_vault/okta/auth_backend_user.py +86 -87
- pulumi_vault/okta/outputs.py +21 -22
- pulumi_vault/outputs.py +81 -82
- pulumi_vault/pkisecret/__init__.py +1 -1
- pulumi_vault/pkisecret/_inputs.py +55 -56
- pulumi_vault/pkisecret/backend_acme_eab.py +116 -117
- pulumi_vault/pkisecret/backend_config_acme.py +175 -176
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +394 -395
- pulumi_vault/pkisecret/backend_config_cluster.py +71 -72
- pulumi_vault/pkisecret/backend_config_cmpv2.py +132 -133
- pulumi_vault/pkisecret/backend_config_est.py +149 -150
- pulumi_vault/pkisecret/backend_config_scep.py +137 -138
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +37 -38
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +32 -33
- pulumi_vault/pkisecret/get_backend_config_est.py +30 -31
- pulumi_vault/pkisecret/get_backend_config_scep.py +29 -30
- pulumi_vault/pkisecret/get_backend_issuer.py +63 -64
- pulumi_vault/pkisecret/get_backend_issuers.py +23 -24
- pulumi_vault/pkisecret/get_backend_key.py +29 -30
- pulumi_vault/pkisecret/get_backend_keys.py +23 -24
- pulumi_vault/pkisecret/outputs.py +61 -62
- pulumi_vault/pkisecret/secret_backend_cert.py +415 -416
- pulumi_vault/pkisecret/secret_backend_config_ca.py +54 -55
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +75 -76
- pulumi_vault/pkisecret/secret_backend_config_urls.py +105 -106
- pulumi_vault/pkisecret/secret_backend_crl_config.py +241 -242
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +515 -516
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +78 -79
- pulumi_vault/pkisecret/secret_backend_issuer.py +286 -287
- pulumi_vault/pkisecret/secret_backend_key.py +146 -147
- pulumi_vault/pkisecret/secret_backend_role.py +873 -874
- pulumi_vault/pkisecret/secret_backend_root_cert.py +677 -678
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +660 -661
- pulumi_vault/pkisecret/secret_backend_sign.py +346 -347
- pulumi_vault/plugin.py +154 -155
- pulumi_vault/plugin_pinned_version.py +52 -53
- pulumi_vault/policy.py +52 -53
- pulumi_vault/provider.py +160 -161
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/quota_lease_count.py +103 -104
- pulumi_vault/quota_rate_limit.py +171 -172
- pulumi_vault/rabbitmq/__init__.py +1 -1
- pulumi_vault/rabbitmq/_inputs.py +50 -51
- pulumi_vault/rabbitmq/outputs.py +34 -35
- pulumi_vault/rabbitmq/secret_backend.py +207 -208
- pulumi_vault/rabbitmq/secret_backend_role.py +79 -80
- pulumi_vault/raft_autopilot.py +137 -138
- pulumi_vault/raft_snapshot_agent_config.py +477 -478
- pulumi_vault/rgp_policy.py +69 -70
- pulumi_vault/saml/__init__.py +1 -1
- pulumi_vault/saml/auth_backend.py +188 -189
- pulumi_vault/saml/auth_backend_role.py +290 -291
- pulumi_vault/scep_auth_backend_role.py +252 -253
- pulumi_vault/secrets/__init__.py +1 -1
- pulumi_vault/secrets/_inputs.py +19 -20
- pulumi_vault/secrets/outputs.py +13 -14
- pulumi_vault/secrets/sync_association.py +88 -89
- pulumi_vault/secrets/sync_aws_destination.py +180 -181
- pulumi_vault/secrets/sync_azure_destination.py +180 -181
- pulumi_vault/secrets/sync_config.py +52 -53
- pulumi_vault/secrets/sync_gcp_destination.py +129 -130
- pulumi_vault/secrets/sync_gh_destination.py +163 -164
- pulumi_vault/secrets/sync_github_apps.py +78 -79
- pulumi_vault/secrets/sync_vercel_destination.py +146 -147
- pulumi_vault/ssh/__init__.py +1 -1
- pulumi_vault/ssh/_inputs.py +13 -14
- pulumi_vault/ssh/get_secret_backend_sign.py +65 -66
- pulumi_vault/ssh/outputs.py +9 -10
- pulumi_vault/ssh/secret_backend_ca.py +120 -121
- pulumi_vault/ssh/secret_backend_role.py +446 -447
- pulumi_vault/terraformcloud/__init__.py +1 -1
- pulumi_vault/terraformcloud/secret_backend.py +138 -139
- pulumi_vault/terraformcloud/secret_creds.py +93 -94
- pulumi_vault/terraformcloud/secret_role.py +117 -118
- pulumi_vault/token.py +301 -302
- pulumi_vault/tokenauth/__init__.py +1 -1
- pulumi_vault/tokenauth/auth_backend_role.py +324 -325
- pulumi_vault/transform/__init__.py +1 -1
- pulumi_vault/transform/alphabet.py +69 -70
- pulumi_vault/transform/get_decode.py +57 -58
- pulumi_vault/transform/get_encode.py +57 -58
- pulumi_vault/transform/role.py +69 -70
- pulumi_vault/transform/template.py +137 -138
- pulumi_vault/transform/transformation.py +171 -172
- pulumi_vault/transit/__init__.py +1 -1
- pulumi_vault/transit/get_cmac.py +47 -48
- pulumi_vault/transit/get_decrypt.py +25 -26
- pulumi_vault/transit/get_encrypt.py +29 -30
- pulumi_vault/transit/get_sign.py +71 -72
- pulumi_vault/transit/get_verify.py +83 -84
- pulumi_vault/transit/secret_backend_key.py +336 -337
- pulumi_vault/transit/secret_cache_config.py +52 -53
- {pulumi_vault-7.2.0a1753339763.dist-info → pulumi_vault-7.2.0a1753398491.dist-info}/METADATA +1 -1
- pulumi_vault-7.2.0a1753398491.dist-info/RECORD +268 -0
- pulumi_vault-7.2.0a1753339763.dist-info/RECORD +0 -268
- {pulumi_vault-7.2.0a1753339763.dist-info → pulumi_vault-7.2.0a1753398491.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.2.0a1753339763.dist-info → pulumi_vault-7.2.0a1753398491.dist-info}/top_level.txt +0 -0
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import builtins
|
|
6
|
-
import copy
|
|
5
|
+
import builtins as _builtins
|
|
7
6
|
import warnings
|
|
8
7
|
import sys
|
|
9
8
|
import pulumi
|
|
@@ -20,48 +19,48 @@ __all__ = ['SecretBackendKeyArgs', 'SecretBackendKey']
|
|
|
20
19
|
@pulumi.input_type
|
|
21
20
|
class SecretBackendKeyArgs:
|
|
22
21
|
def __init__(__self__, *,
|
|
23
|
-
backend: pulumi.Input[
|
|
24
|
-
allow_plaintext_backup: Optional[pulumi.Input[
|
|
25
|
-
auto_rotate_period: Optional[pulumi.Input[
|
|
26
|
-
convergent_encryption: Optional[pulumi.Input[
|
|
27
|
-
deletion_allowed: Optional[pulumi.Input[
|
|
28
|
-
derived: Optional[pulumi.Input[
|
|
29
|
-
exportable: Optional[pulumi.Input[
|
|
30
|
-
hybrid_key_type_ec: Optional[pulumi.Input[
|
|
31
|
-
hybrid_key_type_pqc: Optional[pulumi.Input[
|
|
32
|
-
key_size: Optional[pulumi.Input[
|
|
33
|
-
min_decryption_version: Optional[pulumi.Input[
|
|
34
|
-
min_encryption_version: Optional[pulumi.Input[
|
|
35
|
-
name: Optional[pulumi.Input[
|
|
36
|
-
namespace: Optional[pulumi.Input[
|
|
37
|
-
parameter_set: Optional[pulumi.Input[
|
|
38
|
-
type: Optional[pulumi.Input[
|
|
22
|
+
backend: pulumi.Input[_builtins.str],
|
|
23
|
+
allow_plaintext_backup: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
24
|
+
auto_rotate_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
25
|
+
convergent_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
26
|
+
deletion_allowed: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
27
|
+
derived: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
28
|
+
exportable: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
29
|
+
hybrid_key_type_ec: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
|
+
hybrid_key_type_pqc: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
|
+
key_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
32
|
+
min_decryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
33
|
+
min_encryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
34
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
36
|
+
parameter_set: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
|
+
type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
39
38
|
"""
|
|
40
39
|
The set of arguments for constructing a SecretBackendKey resource.
|
|
41
|
-
:param pulumi.Input[
|
|
42
|
-
:param pulumi.Input[
|
|
40
|
+
:param pulumi.Input[_builtins.str] backend: The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
41
|
+
:param pulumi.Input[_builtins.bool] allow_plaintext_backup: Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
43
42
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
44
|
-
:param pulumi.Input[
|
|
43
|
+
:param pulumi.Input[_builtins.int] auto_rotate_period: Amount of seconds the key should live before being automatically rotated.
|
|
45
44
|
A value of 0 disables automatic rotation for the key.
|
|
46
|
-
:param pulumi.Input[
|
|
47
|
-
:param pulumi.Input[
|
|
48
|
-
:param pulumi.Input[
|
|
49
|
-
:param pulumi.Input[
|
|
50
|
-
:param pulumi.Input[
|
|
45
|
+
:param pulumi.Input[_builtins.bool] convergent_encryption: Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
46
|
+
:param pulumi.Input[_builtins.bool] deletion_allowed: Specifies if the key is allowed to be deleted.
|
|
47
|
+
:param pulumi.Input[_builtins.bool] derived: Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
48
|
+
:param pulumi.Input[_builtins.bool] exportable: Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
49
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_ec: The elliptic curve algorithm to use for hybrid signatures.
|
|
51
50
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
52
|
-
:param pulumi.Input[
|
|
51
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_pqc: The post-quantum algorithm to use for hybrid signatures.
|
|
53
52
|
Currently, ML-DSA is the only supported key type.
|
|
54
|
-
:param pulumi.Input[
|
|
55
|
-
:param pulumi.Input[
|
|
56
|
-
:param pulumi.Input[
|
|
57
|
-
:param pulumi.Input[
|
|
58
|
-
:param pulumi.Input[
|
|
53
|
+
:param pulumi.Input[_builtins.int] key_size: The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
54
|
+
:param pulumi.Input[_builtins.int] min_decryption_version: Minimum key version to use for decryption.
|
|
55
|
+
:param pulumi.Input[_builtins.int] min_encryption_version: Minimum key version to use for encryption
|
|
56
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this key within the backend. Must be unique within the backend.
|
|
57
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
59
58
|
The value should not contain leading or trailing forward slashes.
|
|
60
59
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
61
60
|
*Available only for Vault Enterprise*.
|
|
62
|
-
:param pulumi.Input[
|
|
61
|
+
:param pulumi.Input[_builtins.str] parameter_set: The parameter set to use for ML-DSA. Required for
|
|
63
62
|
ML-DSA and hybrid keys. Valid values are `44`, `65`, and `87`.
|
|
64
|
-
:param pulumi.Input[
|
|
63
|
+
:param pulumi.Input[_builtins.str] type: Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `rsa-4096`.
|
|
65
64
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
66
65
|
"""
|
|
67
66
|
pulumi.set(__self__, "backend", backend)
|
|
@@ -96,21 +95,21 @@ class SecretBackendKeyArgs:
|
|
|
96
95
|
if type is not None:
|
|
97
96
|
pulumi.set(__self__, "type", type)
|
|
98
97
|
|
|
99
|
-
@property
|
|
98
|
+
@_builtins.property
|
|
100
99
|
@pulumi.getter
|
|
101
|
-
def backend(self) -> pulumi.Input[
|
|
100
|
+
def backend(self) -> pulumi.Input[_builtins.str]:
|
|
102
101
|
"""
|
|
103
102
|
The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
104
103
|
"""
|
|
105
104
|
return pulumi.get(self, "backend")
|
|
106
105
|
|
|
107
106
|
@backend.setter
|
|
108
|
-
def backend(self, value: pulumi.Input[
|
|
107
|
+
def backend(self, value: pulumi.Input[_builtins.str]):
|
|
109
108
|
pulumi.set(self, "backend", value)
|
|
110
109
|
|
|
111
|
-
@property
|
|
110
|
+
@_builtins.property
|
|
112
111
|
@pulumi.getter(name="allowPlaintextBackup")
|
|
113
|
-
def allow_plaintext_backup(self) -> Optional[pulumi.Input[
|
|
112
|
+
def allow_plaintext_backup(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
114
113
|
"""
|
|
115
114
|
Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
116
115
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
@@ -118,12 +117,12 @@ class SecretBackendKeyArgs:
|
|
|
118
117
|
return pulumi.get(self, "allow_plaintext_backup")
|
|
119
118
|
|
|
120
119
|
@allow_plaintext_backup.setter
|
|
121
|
-
def allow_plaintext_backup(self, value: Optional[pulumi.Input[
|
|
120
|
+
def allow_plaintext_backup(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
122
121
|
pulumi.set(self, "allow_plaintext_backup", value)
|
|
123
122
|
|
|
124
|
-
@property
|
|
123
|
+
@_builtins.property
|
|
125
124
|
@pulumi.getter(name="autoRotatePeriod")
|
|
126
|
-
def auto_rotate_period(self) -> Optional[pulumi.Input[
|
|
125
|
+
def auto_rotate_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
127
126
|
"""
|
|
128
127
|
Amount of seconds the key should live before being automatically rotated.
|
|
129
128
|
A value of 0 disables automatic rotation for the key.
|
|
@@ -131,60 +130,60 @@ class SecretBackendKeyArgs:
|
|
|
131
130
|
return pulumi.get(self, "auto_rotate_period")
|
|
132
131
|
|
|
133
132
|
@auto_rotate_period.setter
|
|
134
|
-
def auto_rotate_period(self, value: Optional[pulumi.Input[
|
|
133
|
+
def auto_rotate_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
135
134
|
pulumi.set(self, "auto_rotate_period", value)
|
|
136
135
|
|
|
137
|
-
@property
|
|
136
|
+
@_builtins.property
|
|
138
137
|
@pulumi.getter(name="convergentEncryption")
|
|
139
|
-
def convergent_encryption(self) -> Optional[pulumi.Input[
|
|
138
|
+
def convergent_encryption(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
140
139
|
"""
|
|
141
140
|
Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
142
141
|
"""
|
|
143
142
|
return pulumi.get(self, "convergent_encryption")
|
|
144
143
|
|
|
145
144
|
@convergent_encryption.setter
|
|
146
|
-
def convergent_encryption(self, value: Optional[pulumi.Input[
|
|
145
|
+
def convergent_encryption(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
147
146
|
pulumi.set(self, "convergent_encryption", value)
|
|
148
147
|
|
|
149
|
-
@property
|
|
148
|
+
@_builtins.property
|
|
150
149
|
@pulumi.getter(name="deletionAllowed")
|
|
151
|
-
def deletion_allowed(self) -> Optional[pulumi.Input[
|
|
150
|
+
def deletion_allowed(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
152
151
|
"""
|
|
153
152
|
Specifies if the key is allowed to be deleted.
|
|
154
153
|
"""
|
|
155
154
|
return pulumi.get(self, "deletion_allowed")
|
|
156
155
|
|
|
157
156
|
@deletion_allowed.setter
|
|
158
|
-
def deletion_allowed(self, value: Optional[pulumi.Input[
|
|
157
|
+
def deletion_allowed(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
159
158
|
pulumi.set(self, "deletion_allowed", value)
|
|
160
159
|
|
|
161
|
-
@property
|
|
160
|
+
@_builtins.property
|
|
162
161
|
@pulumi.getter
|
|
163
|
-
def derived(self) -> Optional[pulumi.Input[
|
|
162
|
+
def derived(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
164
163
|
"""
|
|
165
164
|
Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
166
165
|
"""
|
|
167
166
|
return pulumi.get(self, "derived")
|
|
168
167
|
|
|
169
168
|
@derived.setter
|
|
170
|
-
def derived(self, value: Optional[pulumi.Input[
|
|
169
|
+
def derived(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
171
170
|
pulumi.set(self, "derived", value)
|
|
172
171
|
|
|
173
|
-
@property
|
|
172
|
+
@_builtins.property
|
|
174
173
|
@pulumi.getter
|
|
175
|
-
def exportable(self) -> Optional[pulumi.Input[
|
|
174
|
+
def exportable(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
176
175
|
"""
|
|
177
176
|
Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
178
177
|
"""
|
|
179
178
|
return pulumi.get(self, "exportable")
|
|
180
179
|
|
|
181
180
|
@exportable.setter
|
|
182
|
-
def exportable(self, value: Optional[pulumi.Input[
|
|
181
|
+
def exportable(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
183
182
|
pulumi.set(self, "exportable", value)
|
|
184
183
|
|
|
185
|
-
@property
|
|
184
|
+
@_builtins.property
|
|
186
185
|
@pulumi.getter(name="hybridKeyTypeEc")
|
|
187
|
-
def hybrid_key_type_ec(self) -> Optional[pulumi.Input[
|
|
186
|
+
def hybrid_key_type_ec(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
188
187
|
"""
|
|
189
188
|
The elliptic curve algorithm to use for hybrid signatures.
|
|
190
189
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
@@ -192,12 +191,12 @@ class SecretBackendKeyArgs:
|
|
|
192
191
|
return pulumi.get(self, "hybrid_key_type_ec")
|
|
193
192
|
|
|
194
193
|
@hybrid_key_type_ec.setter
|
|
195
|
-
def hybrid_key_type_ec(self, value: Optional[pulumi.Input[
|
|
194
|
+
def hybrid_key_type_ec(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
196
195
|
pulumi.set(self, "hybrid_key_type_ec", value)
|
|
197
196
|
|
|
198
|
-
@property
|
|
197
|
+
@_builtins.property
|
|
199
198
|
@pulumi.getter(name="hybridKeyTypePqc")
|
|
200
|
-
def hybrid_key_type_pqc(self) -> Optional[pulumi.Input[
|
|
199
|
+
def hybrid_key_type_pqc(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
201
200
|
"""
|
|
202
201
|
The post-quantum algorithm to use for hybrid signatures.
|
|
203
202
|
Currently, ML-DSA is the only supported key type.
|
|
@@ -205,60 +204,60 @@ class SecretBackendKeyArgs:
|
|
|
205
204
|
return pulumi.get(self, "hybrid_key_type_pqc")
|
|
206
205
|
|
|
207
206
|
@hybrid_key_type_pqc.setter
|
|
208
|
-
def hybrid_key_type_pqc(self, value: Optional[pulumi.Input[
|
|
207
|
+
def hybrid_key_type_pqc(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
209
208
|
pulumi.set(self, "hybrid_key_type_pqc", value)
|
|
210
209
|
|
|
211
|
-
@property
|
|
210
|
+
@_builtins.property
|
|
212
211
|
@pulumi.getter(name="keySize")
|
|
213
|
-
def key_size(self) -> Optional[pulumi.Input[
|
|
212
|
+
def key_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
214
213
|
"""
|
|
215
214
|
The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
216
215
|
"""
|
|
217
216
|
return pulumi.get(self, "key_size")
|
|
218
217
|
|
|
219
218
|
@key_size.setter
|
|
220
|
-
def key_size(self, value: Optional[pulumi.Input[
|
|
219
|
+
def key_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
221
220
|
pulumi.set(self, "key_size", value)
|
|
222
221
|
|
|
223
|
-
@property
|
|
222
|
+
@_builtins.property
|
|
224
223
|
@pulumi.getter(name="minDecryptionVersion")
|
|
225
|
-
def min_decryption_version(self) -> Optional[pulumi.Input[
|
|
224
|
+
def min_decryption_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
226
225
|
"""
|
|
227
226
|
Minimum key version to use for decryption.
|
|
228
227
|
"""
|
|
229
228
|
return pulumi.get(self, "min_decryption_version")
|
|
230
229
|
|
|
231
230
|
@min_decryption_version.setter
|
|
232
|
-
def min_decryption_version(self, value: Optional[pulumi.Input[
|
|
231
|
+
def min_decryption_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
233
232
|
pulumi.set(self, "min_decryption_version", value)
|
|
234
233
|
|
|
235
|
-
@property
|
|
234
|
+
@_builtins.property
|
|
236
235
|
@pulumi.getter(name="minEncryptionVersion")
|
|
237
|
-
def min_encryption_version(self) -> Optional[pulumi.Input[
|
|
236
|
+
def min_encryption_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
238
237
|
"""
|
|
239
238
|
Minimum key version to use for encryption
|
|
240
239
|
"""
|
|
241
240
|
return pulumi.get(self, "min_encryption_version")
|
|
242
241
|
|
|
243
242
|
@min_encryption_version.setter
|
|
244
|
-
def min_encryption_version(self, value: Optional[pulumi.Input[
|
|
243
|
+
def min_encryption_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
245
244
|
pulumi.set(self, "min_encryption_version", value)
|
|
246
245
|
|
|
247
|
-
@property
|
|
246
|
+
@_builtins.property
|
|
248
247
|
@pulumi.getter
|
|
249
|
-
def name(self) -> Optional[pulumi.Input[
|
|
248
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
250
249
|
"""
|
|
251
250
|
The name to identify this key within the backend. Must be unique within the backend.
|
|
252
251
|
"""
|
|
253
252
|
return pulumi.get(self, "name")
|
|
254
253
|
|
|
255
254
|
@name.setter
|
|
256
|
-
def name(self, value: Optional[pulumi.Input[
|
|
255
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
257
256
|
pulumi.set(self, "name", value)
|
|
258
257
|
|
|
259
|
-
@property
|
|
258
|
+
@_builtins.property
|
|
260
259
|
@pulumi.getter
|
|
261
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
260
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
262
261
|
"""
|
|
263
262
|
The namespace to provision the resource in.
|
|
264
263
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -268,12 +267,12 @@ class SecretBackendKeyArgs:
|
|
|
268
267
|
return pulumi.get(self, "namespace")
|
|
269
268
|
|
|
270
269
|
@namespace.setter
|
|
271
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
270
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
272
271
|
pulumi.set(self, "namespace", value)
|
|
273
272
|
|
|
274
|
-
@property
|
|
273
|
+
@_builtins.property
|
|
275
274
|
@pulumi.getter(name="parameterSet")
|
|
276
|
-
def parameter_set(self) -> Optional[pulumi.Input[
|
|
275
|
+
def parameter_set(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
277
276
|
"""
|
|
278
277
|
The parameter set to use for ML-DSA. Required for
|
|
279
278
|
ML-DSA and hybrid keys. Valid values are `44`, `65`, and `87`.
|
|
@@ -281,12 +280,12 @@ class SecretBackendKeyArgs:
|
|
|
281
280
|
return pulumi.get(self, "parameter_set")
|
|
282
281
|
|
|
283
282
|
@parameter_set.setter
|
|
284
|
-
def parameter_set(self, value: Optional[pulumi.Input[
|
|
283
|
+
def parameter_set(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
285
284
|
pulumi.set(self, "parameter_set", value)
|
|
286
285
|
|
|
287
|
-
@property
|
|
286
|
+
@_builtins.property
|
|
288
287
|
@pulumi.getter
|
|
289
|
-
def type(self) -> Optional[pulumi.Input[
|
|
288
|
+
def type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
290
289
|
"""
|
|
291
290
|
Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `rsa-4096`.
|
|
292
291
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
@@ -294,71 +293,71 @@ class SecretBackendKeyArgs:
|
|
|
294
293
|
return pulumi.get(self, "type")
|
|
295
294
|
|
|
296
295
|
@type.setter
|
|
297
|
-
def type(self, value: Optional[pulumi.Input[
|
|
296
|
+
def type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
298
297
|
pulumi.set(self, "type", value)
|
|
299
298
|
|
|
300
299
|
|
|
301
300
|
@pulumi.input_type
|
|
302
301
|
class _SecretBackendKeyState:
|
|
303
302
|
def __init__(__self__, *,
|
|
304
|
-
allow_plaintext_backup: Optional[pulumi.Input[
|
|
305
|
-
auto_rotate_period: Optional[pulumi.Input[
|
|
306
|
-
backend: Optional[pulumi.Input[
|
|
307
|
-
convergent_encryption: Optional[pulumi.Input[
|
|
308
|
-
deletion_allowed: Optional[pulumi.Input[
|
|
309
|
-
derived: Optional[pulumi.Input[
|
|
310
|
-
exportable: Optional[pulumi.Input[
|
|
311
|
-
hybrid_key_type_ec: Optional[pulumi.Input[
|
|
312
|
-
hybrid_key_type_pqc: Optional[pulumi.Input[
|
|
313
|
-
key_size: Optional[pulumi.Input[
|
|
314
|
-
keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
315
|
-
latest_version: Optional[pulumi.Input[
|
|
316
|
-
min_available_version: Optional[pulumi.Input[
|
|
317
|
-
min_decryption_version: Optional[pulumi.Input[
|
|
318
|
-
min_encryption_version: Optional[pulumi.Input[
|
|
319
|
-
name: Optional[pulumi.Input[
|
|
320
|
-
namespace: Optional[pulumi.Input[
|
|
321
|
-
parameter_set: Optional[pulumi.Input[
|
|
322
|
-
supports_decryption: Optional[pulumi.Input[
|
|
323
|
-
supports_derivation: Optional[pulumi.Input[
|
|
324
|
-
supports_encryption: Optional[pulumi.Input[
|
|
325
|
-
supports_signing: Optional[pulumi.Input[
|
|
326
|
-
type: Optional[pulumi.Input[
|
|
303
|
+
allow_plaintext_backup: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
304
|
+
auto_rotate_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
305
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
306
|
+
convergent_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
307
|
+
deletion_allowed: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
308
|
+
derived: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
309
|
+
exportable: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
310
|
+
hybrid_key_type_ec: Optional[pulumi.Input[_builtins.str]] = None,
|
|
311
|
+
hybrid_key_type_pqc: Optional[pulumi.Input[_builtins.str]] = None,
|
|
312
|
+
key_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
313
|
+
keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
314
|
+
latest_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
315
|
+
min_available_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
316
|
+
min_decryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
317
|
+
min_encryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
318
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
319
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
320
|
+
parameter_set: Optional[pulumi.Input[_builtins.str]] = None,
|
|
321
|
+
supports_decryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
322
|
+
supports_derivation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
323
|
+
supports_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
324
|
+
supports_signing: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
325
|
+
type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
327
326
|
"""
|
|
328
327
|
Input properties used for looking up and filtering SecretBackendKey resources.
|
|
329
|
-
:param pulumi.Input[
|
|
328
|
+
:param pulumi.Input[_builtins.bool] allow_plaintext_backup: Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
330
329
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
331
|
-
:param pulumi.Input[
|
|
330
|
+
:param pulumi.Input[_builtins.int] auto_rotate_period: Amount of seconds the key should live before being automatically rotated.
|
|
332
331
|
A value of 0 disables automatic rotation for the key.
|
|
333
|
-
:param pulumi.Input[
|
|
334
|
-
:param pulumi.Input[
|
|
335
|
-
:param pulumi.Input[
|
|
336
|
-
:param pulumi.Input[
|
|
337
|
-
:param pulumi.Input[
|
|
338
|
-
:param pulumi.Input[
|
|
332
|
+
:param pulumi.Input[_builtins.str] backend: The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
333
|
+
:param pulumi.Input[_builtins.bool] convergent_encryption: Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
334
|
+
:param pulumi.Input[_builtins.bool] deletion_allowed: Specifies if the key is allowed to be deleted.
|
|
335
|
+
:param pulumi.Input[_builtins.bool] derived: Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
336
|
+
:param pulumi.Input[_builtins.bool] exportable: Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
337
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_ec: The elliptic curve algorithm to use for hybrid signatures.
|
|
339
338
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
340
|
-
:param pulumi.Input[
|
|
339
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_pqc: The post-quantum algorithm to use for hybrid signatures.
|
|
341
340
|
Currently, ML-DSA is the only supported key type.
|
|
342
|
-
:param pulumi.Input[
|
|
343
|
-
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
341
|
+
:param pulumi.Input[_builtins.int] key_size: The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
342
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] keys: List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
|
|
344
343
|
* for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
|
|
345
344
|
* for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
|
|
346
|
-
:param pulumi.Input[
|
|
347
|
-
:param pulumi.Input[
|
|
348
|
-
:param pulumi.Input[
|
|
349
|
-
:param pulumi.Input[
|
|
350
|
-
:param pulumi.Input[
|
|
351
|
-
:param pulumi.Input[
|
|
345
|
+
:param pulumi.Input[_builtins.int] latest_version: Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
|
|
346
|
+
:param pulumi.Input[_builtins.int] min_available_version: Minimum key version available for use. If keys have been archived by increasing `min_decryption_version`, this attribute will reflect that change.
|
|
347
|
+
:param pulumi.Input[_builtins.int] min_decryption_version: Minimum key version to use for decryption.
|
|
348
|
+
:param pulumi.Input[_builtins.int] min_encryption_version: Minimum key version to use for encryption
|
|
349
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this key within the backend. Must be unique within the backend.
|
|
350
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
352
351
|
The value should not contain leading or trailing forward slashes.
|
|
353
352
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
354
353
|
*Available only for Vault Enterprise*.
|
|
355
|
-
:param pulumi.Input[
|
|
354
|
+
:param pulumi.Input[_builtins.str] parameter_set: The parameter set to use for ML-DSA. Required for
|
|
356
355
|
ML-DSA and hybrid keys. Valid values are `44`, `65`, and `87`.
|
|
357
|
-
:param pulumi.Input[
|
|
358
|
-
:param pulumi.Input[
|
|
359
|
-
:param pulumi.Input[
|
|
360
|
-
:param pulumi.Input[
|
|
361
|
-
:param pulumi.Input[
|
|
356
|
+
:param pulumi.Input[_builtins.bool] supports_decryption: Whether or not the key supports decryption, based on key type.
|
|
357
|
+
:param pulumi.Input[_builtins.bool] supports_derivation: Whether or not the key supports derivation, based on key type.
|
|
358
|
+
:param pulumi.Input[_builtins.bool] supports_encryption: Whether or not the key supports encryption, based on key type.
|
|
359
|
+
:param pulumi.Input[_builtins.bool] supports_signing: Whether or not the key supports signing, based on key type.
|
|
360
|
+
:param pulumi.Input[_builtins.str] type: Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `rsa-4096`.
|
|
362
361
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
363
362
|
"""
|
|
364
363
|
if allow_plaintext_backup is not None:
|
|
@@ -408,9 +407,9 @@ class _SecretBackendKeyState:
|
|
|
408
407
|
if type is not None:
|
|
409
408
|
pulumi.set(__self__, "type", type)
|
|
410
409
|
|
|
411
|
-
@property
|
|
410
|
+
@_builtins.property
|
|
412
411
|
@pulumi.getter(name="allowPlaintextBackup")
|
|
413
|
-
def allow_plaintext_backup(self) -> Optional[pulumi.Input[
|
|
412
|
+
def allow_plaintext_backup(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
414
413
|
"""
|
|
415
414
|
Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
416
415
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
@@ -418,12 +417,12 @@ class _SecretBackendKeyState:
|
|
|
418
417
|
return pulumi.get(self, "allow_plaintext_backup")
|
|
419
418
|
|
|
420
419
|
@allow_plaintext_backup.setter
|
|
421
|
-
def allow_plaintext_backup(self, value: Optional[pulumi.Input[
|
|
420
|
+
def allow_plaintext_backup(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
422
421
|
pulumi.set(self, "allow_plaintext_backup", value)
|
|
423
422
|
|
|
424
|
-
@property
|
|
423
|
+
@_builtins.property
|
|
425
424
|
@pulumi.getter(name="autoRotatePeriod")
|
|
426
|
-
def auto_rotate_period(self) -> Optional[pulumi.Input[
|
|
425
|
+
def auto_rotate_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
427
426
|
"""
|
|
428
427
|
Amount of seconds the key should live before being automatically rotated.
|
|
429
428
|
A value of 0 disables automatic rotation for the key.
|
|
@@ -431,72 +430,72 @@ class _SecretBackendKeyState:
|
|
|
431
430
|
return pulumi.get(self, "auto_rotate_period")
|
|
432
431
|
|
|
433
432
|
@auto_rotate_period.setter
|
|
434
|
-
def auto_rotate_period(self, value: Optional[pulumi.Input[
|
|
433
|
+
def auto_rotate_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
435
434
|
pulumi.set(self, "auto_rotate_period", value)
|
|
436
435
|
|
|
437
|
-
@property
|
|
436
|
+
@_builtins.property
|
|
438
437
|
@pulumi.getter
|
|
439
|
-
def backend(self) -> Optional[pulumi.Input[
|
|
438
|
+
def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
440
439
|
"""
|
|
441
440
|
The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
442
441
|
"""
|
|
443
442
|
return pulumi.get(self, "backend")
|
|
444
443
|
|
|
445
444
|
@backend.setter
|
|
446
|
-
def backend(self, value: Optional[pulumi.Input[
|
|
445
|
+
def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
447
446
|
pulumi.set(self, "backend", value)
|
|
448
447
|
|
|
449
|
-
@property
|
|
448
|
+
@_builtins.property
|
|
450
449
|
@pulumi.getter(name="convergentEncryption")
|
|
451
|
-
def convergent_encryption(self) -> Optional[pulumi.Input[
|
|
450
|
+
def convergent_encryption(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
452
451
|
"""
|
|
453
452
|
Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
454
453
|
"""
|
|
455
454
|
return pulumi.get(self, "convergent_encryption")
|
|
456
455
|
|
|
457
456
|
@convergent_encryption.setter
|
|
458
|
-
def convergent_encryption(self, value: Optional[pulumi.Input[
|
|
457
|
+
def convergent_encryption(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
459
458
|
pulumi.set(self, "convergent_encryption", value)
|
|
460
459
|
|
|
461
|
-
@property
|
|
460
|
+
@_builtins.property
|
|
462
461
|
@pulumi.getter(name="deletionAllowed")
|
|
463
|
-
def deletion_allowed(self) -> Optional[pulumi.Input[
|
|
462
|
+
def deletion_allowed(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
464
463
|
"""
|
|
465
464
|
Specifies if the key is allowed to be deleted.
|
|
466
465
|
"""
|
|
467
466
|
return pulumi.get(self, "deletion_allowed")
|
|
468
467
|
|
|
469
468
|
@deletion_allowed.setter
|
|
470
|
-
def deletion_allowed(self, value: Optional[pulumi.Input[
|
|
469
|
+
def deletion_allowed(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
471
470
|
pulumi.set(self, "deletion_allowed", value)
|
|
472
471
|
|
|
473
|
-
@property
|
|
472
|
+
@_builtins.property
|
|
474
473
|
@pulumi.getter
|
|
475
|
-
def derived(self) -> Optional[pulumi.Input[
|
|
474
|
+
def derived(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
476
475
|
"""
|
|
477
476
|
Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
478
477
|
"""
|
|
479
478
|
return pulumi.get(self, "derived")
|
|
480
479
|
|
|
481
480
|
@derived.setter
|
|
482
|
-
def derived(self, value: Optional[pulumi.Input[
|
|
481
|
+
def derived(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
483
482
|
pulumi.set(self, "derived", value)
|
|
484
483
|
|
|
485
|
-
@property
|
|
484
|
+
@_builtins.property
|
|
486
485
|
@pulumi.getter
|
|
487
|
-
def exportable(self) -> Optional[pulumi.Input[
|
|
486
|
+
def exportable(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
488
487
|
"""
|
|
489
488
|
Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
490
489
|
"""
|
|
491
490
|
return pulumi.get(self, "exportable")
|
|
492
491
|
|
|
493
492
|
@exportable.setter
|
|
494
|
-
def exportable(self, value: Optional[pulumi.Input[
|
|
493
|
+
def exportable(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
495
494
|
pulumi.set(self, "exportable", value)
|
|
496
495
|
|
|
497
|
-
@property
|
|
496
|
+
@_builtins.property
|
|
498
497
|
@pulumi.getter(name="hybridKeyTypeEc")
|
|
499
|
-
def hybrid_key_type_ec(self) -> Optional[pulumi.Input[
|
|
498
|
+
def hybrid_key_type_ec(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
500
499
|
"""
|
|
501
500
|
The elliptic curve algorithm to use for hybrid signatures.
|
|
502
501
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
@@ -504,12 +503,12 @@ class _SecretBackendKeyState:
|
|
|
504
503
|
return pulumi.get(self, "hybrid_key_type_ec")
|
|
505
504
|
|
|
506
505
|
@hybrid_key_type_ec.setter
|
|
507
|
-
def hybrid_key_type_ec(self, value: Optional[pulumi.Input[
|
|
506
|
+
def hybrid_key_type_ec(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
508
507
|
pulumi.set(self, "hybrid_key_type_ec", value)
|
|
509
508
|
|
|
510
|
-
@property
|
|
509
|
+
@_builtins.property
|
|
511
510
|
@pulumi.getter(name="hybridKeyTypePqc")
|
|
512
|
-
def hybrid_key_type_pqc(self) -> Optional[pulumi.Input[
|
|
511
|
+
def hybrid_key_type_pqc(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
513
512
|
"""
|
|
514
513
|
The post-quantum algorithm to use for hybrid signatures.
|
|
515
514
|
Currently, ML-DSA is the only supported key type.
|
|
@@ -517,24 +516,24 @@ class _SecretBackendKeyState:
|
|
|
517
516
|
return pulumi.get(self, "hybrid_key_type_pqc")
|
|
518
517
|
|
|
519
518
|
@hybrid_key_type_pqc.setter
|
|
520
|
-
def hybrid_key_type_pqc(self, value: Optional[pulumi.Input[
|
|
519
|
+
def hybrid_key_type_pqc(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
521
520
|
pulumi.set(self, "hybrid_key_type_pqc", value)
|
|
522
521
|
|
|
523
|
-
@property
|
|
522
|
+
@_builtins.property
|
|
524
523
|
@pulumi.getter(name="keySize")
|
|
525
|
-
def key_size(self) -> Optional[pulumi.Input[
|
|
524
|
+
def key_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
526
525
|
"""
|
|
527
526
|
The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
528
527
|
"""
|
|
529
528
|
return pulumi.get(self, "key_size")
|
|
530
529
|
|
|
531
530
|
@key_size.setter
|
|
532
|
-
def key_size(self, value: Optional[pulumi.Input[
|
|
531
|
+
def key_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
533
532
|
pulumi.set(self, "key_size", value)
|
|
534
533
|
|
|
535
|
-
@property
|
|
534
|
+
@_builtins.property
|
|
536
535
|
@pulumi.getter
|
|
537
|
-
def keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
536
|
+
def keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]:
|
|
538
537
|
"""
|
|
539
538
|
List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
|
|
540
539
|
* for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
|
|
@@ -543,72 +542,72 @@ class _SecretBackendKeyState:
|
|
|
543
542
|
return pulumi.get(self, "keys")
|
|
544
543
|
|
|
545
544
|
@keys.setter
|
|
546
|
-
def keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
545
|
+
def keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]):
|
|
547
546
|
pulumi.set(self, "keys", value)
|
|
548
547
|
|
|
549
|
-
@property
|
|
548
|
+
@_builtins.property
|
|
550
549
|
@pulumi.getter(name="latestVersion")
|
|
551
|
-
def latest_version(self) -> Optional[pulumi.Input[
|
|
550
|
+
def latest_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
552
551
|
"""
|
|
553
552
|
Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
|
|
554
553
|
"""
|
|
555
554
|
return pulumi.get(self, "latest_version")
|
|
556
555
|
|
|
557
556
|
@latest_version.setter
|
|
558
|
-
def latest_version(self, value: Optional[pulumi.Input[
|
|
557
|
+
def latest_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
559
558
|
pulumi.set(self, "latest_version", value)
|
|
560
559
|
|
|
561
|
-
@property
|
|
560
|
+
@_builtins.property
|
|
562
561
|
@pulumi.getter(name="minAvailableVersion")
|
|
563
|
-
def min_available_version(self) -> Optional[pulumi.Input[
|
|
562
|
+
def min_available_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
564
563
|
"""
|
|
565
564
|
Minimum key version available for use. If keys have been archived by increasing `min_decryption_version`, this attribute will reflect that change.
|
|
566
565
|
"""
|
|
567
566
|
return pulumi.get(self, "min_available_version")
|
|
568
567
|
|
|
569
568
|
@min_available_version.setter
|
|
570
|
-
def min_available_version(self, value: Optional[pulumi.Input[
|
|
569
|
+
def min_available_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
571
570
|
pulumi.set(self, "min_available_version", value)
|
|
572
571
|
|
|
573
|
-
@property
|
|
572
|
+
@_builtins.property
|
|
574
573
|
@pulumi.getter(name="minDecryptionVersion")
|
|
575
|
-
def min_decryption_version(self) -> Optional[pulumi.Input[
|
|
574
|
+
def min_decryption_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
576
575
|
"""
|
|
577
576
|
Minimum key version to use for decryption.
|
|
578
577
|
"""
|
|
579
578
|
return pulumi.get(self, "min_decryption_version")
|
|
580
579
|
|
|
581
580
|
@min_decryption_version.setter
|
|
582
|
-
def min_decryption_version(self, value: Optional[pulumi.Input[
|
|
581
|
+
def min_decryption_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
583
582
|
pulumi.set(self, "min_decryption_version", value)
|
|
584
583
|
|
|
585
|
-
@property
|
|
584
|
+
@_builtins.property
|
|
586
585
|
@pulumi.getter(name="minEncryptionVersion")
|
|
587
|
-
def min_encryption_version(self) -> Optional[pulumi.Input[
|
|
586
|
+
def min_encryption_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
588
587
|
"""
|
|
589
588
|
Minimum key version to use for encryption
|
|
590
589
|
"""
|
|
591
590
|
return pulumi.get(self, "min_encryption_version")
|
|
592
591
|
|
|
593
592
|
@min_encryption_version.setter
|
|
594
|
-
def min_encryption_version(self, value: Optional[pulumi.Input[
|
|
593
|
+
def min_encryption_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
595
594
|
pulumi.set(self, "min_encryption_version", value)
|
|
596
595
|
|
|
597
|
-
@property
|
|
596
|
+
@_builtins.property
|
|
598
597
|
@pulumi.getter
|
|
599
|
-
def name(self) -> Optional[pulumi.Input[
|
|
598
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
600
599
|
"""
|
|
601
600
|
The name to identify this key within the backend. Must be unique within the backend.
|
|
602
601
|
"""
|
|
603
602
|
return pulumi.get(self, "name")
|
|
604
603
|
|
|
605
604
|
@name.setter
|
|
606
|
-
def name(self, value: Optional[pulumi.Input[
|
|
605
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
607
606
|
pulumi.set(self, "name", value)
|
|
608
607
|
|
|
609
|
-
@property
|
|
608
|
+
@_builtins.property
|
|
610
609
|
@pulumi.getter
|
|
611
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
610
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
612
611
|
"""
|
|
613
612
|
The namespace to provision the resource in.
|
|
614
613
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -618,12 +617,12 @@ class _SecretBackendKeyState:
|
|
|
618
617
|
return pulumi.get(self, "namespace")
|
|
619
618
|
|
|
620
619
|
@namespace.setter
|
|
621
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
620
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
622
621
|
pulumi.set(self, "namespace", value)
|
|
623
622
|
|
|
624
|
-
@property
|
|
623
|
+
@_builtins.property
|
|
625
624
|
@pulumi.getter(name="parameterSet")
|
|
626
|
-
def parameter_set(self) -> Optional[pulumi.Input[
|
|
625
|
+
def parameter_set(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
627
626
|
"""
|
|
628
627
|
The parameter set to use for ML-DSA. Required for
|
|
629
628
|
ML-DSA and hybrid keys. Valid values are `44`, `65`, and `87`.
|
|
@@ -631,60 +630,60 @@ class _SecretBackendKeyState:
|
|
|
631
630
|
return pulumi.get(self, "parameter_set")
|
|
632
631
|
|
|
633
632
|
@parameter_set.setter
|
|
634
|
-
def parameter_set(self, value: Optional[pulumi.Input[
|
|
633
|
+
def parameter_set(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
635
634
|
pulumi.set(self, "parameter_set", value)
|
|
636
635
|
|
|
637
|
-
@property
|
|
636
|
+
@_builtins.property
|
|
638
637
|
@pulumi.getter(name="supportsDecryption")
|
|
639
|
-
def supports_decryption(self) -> Optional[pulumi.Input[
|
|
638
|
+
def supports_decryption(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
640
639
|
"""
|
|
641
640
|
Whether or not the key supports decryption, based on key type.
|
|
642
641
|
"""
|
|
643
642
|
return pulumi.get(self, "supports_decryption")
|
|
644
643
|
|
|
645
644
|
@supports_decryption.setter
|
|
646
|
-
def supports_decryption(self, value: Optional[pulumi.Input[
|
|
645
|
+
def supports_decryption(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
647
646
|
pulumi.set(self, "supports_decryption", value)
|
|
648
647
|
|
|
649
|
-
@property
|
|
648
|
+
@_builtins.property
|
|
650
649
|
@pulumi.getter(name="supportsDerivation")
|
|
651
|
-
def supports_derivation(self) -> Optional[pulumi.Input[
|
|
650
|
+
def supports_derivation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
652
651
|
"""
|
|
653
652
|
Whether or not the key supports derivation, based on key type.
|
|
654
653
|
"""
|
|
655
654
|
return pulumi.get(self, "supports_derivation")
|
|
656
655
|
|
|
657
656
|
@supports_derivation.setter
|
|
658
|
-
def supports_derivation(self, value: Optional[pulumi.Input[
|
|
657
|
+
def supports_derivation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
659
658
|
pulumi.set(self, "supports_derivation", value)
|
|
660
659
|
|
|
661
|
-
@property
|
|
660
|
+
@_builtins.property
|
|
662
661
|
@pulumi.getter(name="supportsEncryption")
|
|
663
|
-
def supports_encryption(self) -> Optional[pulumi.Input[
|
|
662
|
+
def supports_encryption(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
664
663
|
"""
|
|
665
664
|
Whether or not the key supports encryption, based on key type.
|
|
666
665
|
"""
|
|
667
666
|
return pulumi.get(self, "supports_encryption")
|
|
668
667
|
|
|
669
668
|
@supports_encryption.setter
|
|
670
|
-
def supports_encryption(self, value: Optional[pulumi.Input[
|
|
669
|
+
def supports_encryption(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
671
670
|
pulumi.set(self, "supports_encryption", value)
|
|
672
671
|
|
|
673
|
-
@property
|
|
672
|
+
@_builtins.property
|
|
674
673
|
@pulumi.getter(name="supportsSigning")
|
|
675
|
-
def supports_signing(self) -> Optional[pulumi.Input[
|
|
674
|
+
def supports_signing(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
676
675
|
"""
|
|
677
676
|
Whether or not the key supports signing, based on key type.
|
|
678
677
|
"""
|
|
679
678
|
return pulumi.get(self, "supports_signing")
|
|
680
679
|
|
|
681
680
|
@supports_signing.setter
|
|
682
|
-
def supports_signing(self, value: Optional[pulumi.Input[
|
|
681
|
+
def supports_signing(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
683
682
|
pulumi.set(self, "supports_signing", value)
|
|
684
683
|
|
|
685
|
-
@property
|
|
684
|
+
@_builtins.property
|
|
686
685
|
@pulumi.getter
|
|
687
|
-
def type(self) -> Optional[pulumi.Input[
|
|
686
|
+
def type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
688
687
|
"""
|
|
689
688
|
Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `rsa-4096`.
|
|
690
689
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
@@ -692,7 +691,7 @@ class _SecretBackendKeyState:
|
|
|
692
691
|
return pulumi.get(self, "type")
|
|
693
692
|
|
|
694
693
|
@type.setter
|
|
695
|
-
def type(self, value: Optional[pulumi.Input[
|
|
694
|
+
def type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
696
695
|
pulumi.set(self, "type", value)
|
|
697
696
|
|
|
698
697
|
|
|
@@ -702,22 +701,22 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
702
701
|
def __init__(__self__,
|
|
703
702
|
resource_name: str,
|
|
704
703
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
705
|
-
allow_plaintext_backup: Optional[pulumi.Input[
|
|
706
|
-
auto_rotate_period: Optional[pulumi.Input[
|
|
707
|
-
backend: Optional[pulumi.Input[
|
|
708
|
-
convergent_encryption: Optional[pulumi.Input[
|
|
709
|
-
deletion_allowed: Optional[pulumi.Input[
|
|
710
|
-
derived: Optional[pulumi.Input[
|
|
711
|
-
exportable: Optional[pulumi.Input[
|
|
712
|
-
hybrid_key_type_ec: Optional[pulumi.Input[
|
|
713
|
-
hybrid_key_type_pqc: Optional[pulumi.Input[
|
|
714
|
-
key_size: Optional[pulumi.Input[
|
|
715
|
-
min_decryption_version: Optional[pulumi.Input[
|
|
716
|
-
min_encryption_version: Optional[pulumi.Input[
|
|
717
|
-
name: Optional[pulumi.Input[
|
|
718
|
-
namespace: Optional[pulumi.Input[
|
|
719
|
-
parameter_set: Optional[pulumi.Input[
|
|
720
|
-
type: Optional[pulumi.Input[
|
|
704
|
+
allow_plaintext_backup: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
705
|
+
auto_rotate_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
706
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
707
|
+
convergent_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
708
|
+
deletion_allowed: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
709
|
+
derived: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
710
|
+
exportable: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
711
|
+
hybrid_key_type_ec: Optional[pulumi.Input[_builtins.str]] = None,
|
|
712
|
+
hybrid_key_type_pqc: Optional[pulumi.Input[_builtins.str]] = None,
|
|
713
|
+
key_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
714
|
+
min_decryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
715
|
+
min_encryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
716
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
717
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
718
|
+
parameter_set: Optional[pulumi.Input[_builtins.str]] = None,
|
|
719
|
+
type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
721
720
|
__props__=None):
|
|
722
721
|
"""
|
|
723
722
|
Creates an Encryption Keyring on a Transit Secret Backend for Vault.
|
|
@@ -749,30 +748,30 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
749
748
|
|
|
750
749
|
:param str resource_name: The name of the resource.
|
|
751
750
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
752
|
-
:param pulumi.Input[
|
|
751
|
+
:param pulumi.Input[_builtins.bool] allow_plaintext_backup: Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
753
752
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
754
|
-
:param pulumi.Input[
|
|
753
|
+
:param pulumi.Input[_builtins.int] auto_rotate_period: Amount of seconds the key should live before being automatically rotated.
|
|
755
754
|
A value of 0 disables automatic rotation for the key.
|
|
756
|
-
:param pulumi.Input[
|
|
757
|
-
:param pulumi.Input[
|
|
758
|
-
:param pulumi.Input[
|
|
759
|
-
:param pulumi.Input[
|
|
760
|
-
:param pulumi.Input[
|
|
761
|
-
:param pulumi.Input[
|
|
755
|
+
:param pulumi.Input[_builtins.str] backend: The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
756
|
+
:param pulumi.Input[_builtins.bool] convergent_encryption: Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
757
|
+
:param pulumi.Input[_builtins.bool] deletion_allowed: Specifies if the key is allowed to be deleted.
|
|
758
|
+
:param pulumi.Input[_builtins.bool] derived: Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
759
|
+
:param pulumi.Input[_builtins.bool] exportable: Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
760
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_ec: The elliptic curve algorithm to use for hybrid signatures.
|
|
762
761
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
763
|
-
:param pulumi.Input[
|
|
762
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_pqc: The post-quantum algorithm to use for hybrid signatures.
|
|
764
763
|
Currently, ML-DSA is the only supported key type.
|
|
765
|
-
:param pulumi.Input[
|
|
766
|
-
:param pulumi.Input[
|
|
767
|
-
:param pulumi.Input[
|
|
768
|
-
:param pulumi.Input[
|
|
769
|
-
:param pulumi.Input[
|
|
764
|
+
:param pulumi.Input[_builtins.int] key_size: The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
765
|
+
:param pulumi.Input[_builtins.int] min_decryption_version: Minimum key version to use for decryption.
|
|
766
|
+
:param pulumi.Input[_builtins.int] min_encryption_version: Minimum key version to use for encryption
|
|
767
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this key within the backend. Must be unique within the backend.
|
|
768
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
770
769
|
The value should not contain leading or trailing forward slashes.
|
|
771
770
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
772
771
|
*Available only for Vault Enterprise*.
|
|
773
|
-
:param pulumi.Input[
|
|
772
|
+
:param pulumi.Input[_builtins.str] parameter_set: The parameter set to use for ML-DSA. Required for
|
|
774
773
|
ML-DSA and hybrid keys. Valid values are `44`, `65`, and `87`.
|
|
775
|
-
:param pulumi.Input[
|
|
774
|
+
:param pulumi.Input[_builtins.str] type: Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `rsa-4096`.
|
|
776
775
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
777
776
|
"""
|
|
778
777
|
...
|
|
@@ -824,22 +823,22 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
824
823
|
def _internal_init(__self__,
|
|
825
824
|
resource_name: str,
|
|
826
825
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
827
|
-
allow_plaintext_backup: Optional[pulumi.Input[
|
|
828
|
-
auto_rotate_period: Optional[pulumi.Input[
|
|
829
|
-
backend: Optional[pulumi.Input[
|
|
830
|
-
convergent_encryption: Optional[pulumi.Input[
|
|
831
|
-
deletion_allowed: Optional[pulumi.Input[
|
|
832
|
-
derived: Optional[pulumi.Input[
|
|
833
|
-
exportable: Optional[pulumi.Input[
|
|
834
|
-
hybrid_key_type_ec: Optional[pulumi.Input[
|
|
835
|
-
hybrid_key_type_pqc: Optional[pulumi.Input[
|
|
836
|
-
key_size: Optional[pulumi.Input[
|
|
837
|
-
min_decryption_version: Optional[pulumi.Input[
|
|
838
|
-
min_encryption_version: Optional[pulumi.Input[
|
|
839
|
-
name: Optional[pulumi.Input[
|
|
840
|
-
namespace: Optional[pulumi.Input[
|
|
841
|
-
parameter_set: Optional[pulumi.Input[
|
|
842
|
-
type: Optional[pulumi.Input[
|
|
826
|
+
allow_plaintext_backup: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
827
|
+
auto_rotate_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
828
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
829
|
+
convergent_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
830
|
+
deletion_allowed: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
831
|
+
derived: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
832
|
+
exportable: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
833
|
+
hybrid_key_type_ec: Optional[pulumi.Input[_builtins.str]] = None,
|
|
834
|
+
hybrid_key_type_pqc: Optional[pulumi.Input[_builtins.str]] = None,
|
|
835
|
+
key_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
836
|
+
min_decryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
837
|
+
min_encryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
838
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
839
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
840
|
+
parameter_set: Optional[pulumi.Input[_builtins.str]] = None,
|
|
841
|
+
type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
843
842
|
__props__=None):
|
|
844
843
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
845
844
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -884,29 +883,29 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
884
883
|
def get(resource_name: str,
|
|
885
884
|
id: pulumi.Input[str],
|
|
886
885
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
887
|
-
allow_plaintext_backup: Optional[pulumi.Input[
|
|
888
|
-
auto_rotate_period: Optional[pulumi.Input[
|
|
889
|
-
backend: Optional[pulumi.Input[
|
|
890
|
-
convergent_encryption: Optional[pulumi.Input[
|
|
891
|
-
deletion_allowed: Optional[pulumi.Input[
|
|
892
|
-
derived: Optional[pulumi.Input[
|
|
893
|
-
exportable: Optional[pulumi.Input[
|
|
894
|
-
hybrid_key_type_ec: Optional[pulumi.Input[
|
|
895
|
-
hybrid_key_type_pqc: Optional[pulumi.Input[
|
|
896
|
-
key_size: Optional[pulumi.Input[
|
|
897
|
-
keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
898
|
-
latest_version: Optional[pulumi.Input[
|
|
899
|
-
min_available_version: Optional[pulumi.Input[
|
|
900
|
-
min_decryption_version: Optional[pulumi.Input[
|
|
901
|
-
min_encryption_version: Optional[pulumi.Input[
|
|
902
|
-
name: Optional[pulumi.Input[
|
|
903
|
-
namespace: Optional[pulumi.Input[
|
|
904
|
-
parameter_set: Optional[pulumi.Input[
|
|
905
|
-
supports_decryption: Optional[pulumi.Input[
|
|
906
|
-
supports_derivation: Optional[pulumi.Input[
|
|
907
|
-
supports_encryption: Optional[pulumi.Input[
|
|
908
|
-
supports_signing: Optional[pulumi.Input[
|
|
909
|
-
type: Optional[pulumi.Input[
|
|
886
|
+
allow_plaintext_backup: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
887
|
+
auto_rotate_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
888
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
889
|
+
convergent_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
890
|
+
deletion_allowed: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
891
|
+
derived: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
892
|
+
exportable: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
893
|
+
hybrid_key_type_ec: Optional[pulumi.Input[_builtins.str]] = None,
|
|
894
|
+
hybrid_key_type_pqc: Optional[pulumi.Input[_builtins.str]] = None,
|
|
895
|
+
key_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
896
|
+
keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
897
|
+
latest_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
898
|
+
min_available_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
899
|
+
min_decryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
900
|
+
min_encryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
901
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
902
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
903
|
+
parameter_set: Optional[pulumi.Input[_builtins.str]] = None,
|
|
904
|
+
supports_decryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
905
|
+
supports_derivation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
906
|
+
supports_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
907
|
+
supports_signing: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
908
|
+
type: Optional[pulumi.Input[_builtins.str]] = None) -> 'SecretBackendKey':
|
|
910
909
|
"""
|
|
911
910
|
Get an existing SecretBackendKey resource's state with the given name, id, and optional extra
|
|
912
911
|
properties used to qualify the lookup.
|
|
@@ -914,39 +913,39 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
914
913
|
:param str resource_name: The unique name of the resulting resource.
|
|
915
914
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
916
915
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
917
|
-
:param pulumi.Input[
|
|
916
|
+
:param pulumi.Input[_builtins.bool] allow_plaintext_backup: Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
918
917
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
919
|
-
:param pulumi.Input[
|
|
918
|
+
:param pulumi.Input[_builtins.int] auto_rotate_period: Amount of seconds the key should live before being automatically rotated.
|
|
920
919
|
A value of 0 disables automatic rotation for the key.
|
|
921
|
-
:param pulumi.Input[
|
|
922
|
-
:param pulumi.Input[
|
|
923
|
-
:param pulumi.Input[
|
|
924
|
-
:param pulumi.Input[
|
|
925
|
-
:param pulumi.Input[
|
|
926
|
-
:param pulumi.Input[
|
|
920
|
+
:param pulumi.Input[_builtins.str] backend: The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
921
|
+
:param pulumi.Input[_builtins.bool] convergent_encryption: Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
922
|
+
:param pulumi.Input[_builtins.bool] deletion_allowed: Specifies if the key is allowed to be deleted.
|
|
923
|
+
:param pulumi.Input[_builtins.bool] derived: Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
924
|
+
:param pulumi.Input[_builtins.bool] exportable: Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
925
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_ec: The elliptic curve algorithm to use for hybrid signatures.
|
|
927
926
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
928
|
-
:param pulumi.Input[
|
|
927
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_pqc: The post-quantum algorithm to use for hybrid signatures.
|
|
929
928
|
Currently, ML-DSA is the only supported key type.
|
|
930
|
-
:param pulumi.Input[
|
|
931
|
-
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
929
|
+
:param pulumi.Input[_builtins.int] key_size: The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
930
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] keys: List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
|
|
932
931
|
* for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
|
|
933
932
|
* for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
|
|
934
|
-
:param pulumi.Input[
|
|
935
|
-
:param pulumi.Input[
|
|
936
|
-
:param pulumi.Input[
|
|
937
|
-
:param pulumi.Input[
|
|
938
|
-
:param pulumi.Input[
|
|
939
|
-
:param pulumi.Input[
|
|
933
|
+
:param pulumi.Input[_builtins.int] latest_version: Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
|
|
934
|
+
:param pulumi.Input[_builtins.int] min_available_version: Minimum key version available for use. If keys have been archived by increasing `min_decryption_version`, this attribute will reflect that change.
|
|
935
|
+
:param pulumi.Input[_builtins.int] min_decryption_version: Minimum key version to use for decryption.
|
|
936
|
+
:param pulumi.Input[_builtins.int] min_encryption_version: Minimum key version to use for encryption
|
|
937
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this key within the backend. Must be unique within the backend.
|
|
938
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
940
939
|
The value should not contain leading or trailing forward slashes.
|
|
941
940
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
942
941
|
*Available only for Vault Enterprise*.
|
|
943
|
-
:param pulumi.Input[
|
|
942
|
+
:param pulumi.Input[_builtins.str] parameter_set: The parameter set to use for ML-DSA. Required for
|
|
944
943
|
ML-DSA and hybrid keys. Valid values are `44`, `65`, and `87`.
|
|
945
|
-
:param pulumi.Input[
|
|
946
|
-
:param pulumi.Input[
|
|
947
|
-
:param pulumi.Input[
|
|
948
|
-
:param pulumi.Input[
|
|
949
|
-
:param pulumi.Input[
|
|
944
|
+
:param pulumi.Input[_builtins.bool] supports_decryption: Whether or not the key supports decryption, based on key type.
|
|
945
|
+
:param pulumi.Input[_builtins.bool] supports_derivation: Whether or not the key supports derivation, based on key type.
|
|
946
|
+
:param pulumi.Input[_builtins.bool] supports_encryption: Whether or not the key supports encryption, based on key type.
|
|
947
|
+
:param pulumi.Input[_builtins.bool] supports_signing: Whether or not the key supports signing, based on key type.
|
|
948
|
+
:param pulumi.Input[_builtins.str] type: Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `rsa-4096`.
|
|
950
949
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
951
950
|
"""
|
|
952
951
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
@@ -978,93 +977,93 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
978
977
|
__props__.__dict__["type"] = type
|
|
979
978
|
return SecretBackendKey(resource_name, opts=opts, __props__=__props__)
|
|
980
979
|
|
|
981
|
-
@property
|
|
980
|
+
@_builtins.property
|
|
982
981
|
@pulumi.getter(name="allowPlaintextBackup")
|
|
983
|
-
def allow_plaintext_backup(self) -> pulumi.Output[Optional[
|
|
982
|
+
def allow_plaintext_backup(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
984
983
|
"""
|
|
985
984
|
Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
986
985
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
987
986
|
"""
|
|
988
987
|
return pulumi.get(self, "allow_plaintext_backup")
|
|
989
988
|
|
|
990
|
-
@property
|
|
989
|
+
@_builtins.property
|
|
991
990
|
@pulumi.getter(name="autoRotatePeriod")
|
|
992
|
-
def auto_rotate_period(self) -> pulumi.Output[
|
|
991
|
+
def auto_rotate_period(self) -> pulumi.Output[_builtins.int]:
|
|
993
992
|
"""
|
|
994
993
|
Amount of seconds the key should live before being automatically rotated.
|
|
995
994
|
A value of 0 disables automatic rotation for the key.
|
|
996
995
|
"""
|
|
997
996
|
return pulumi.get(self, "auto_rotate_period")
|
|
998
997
|
|
|
999
|
-
@property
|
|
998
|
+
@_builtins.property
|
|
1000
999
|
@pulumi.getter
|
|
1001
|
-
def backend(self) -> pulumi.Output[
|
|
1000
|
+
def backend(self) -> pulumi.Output[_builtins.str]:
|
|
1002
1001
|
"""
|
|
1003
1002
|
The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
1004
1003
|
"""
|
|
1005
1004
|
return pulumi.get(self, "backend")
|
|
1006
1005
|
|
|
1007
|
-
@property
|
|
1006
|
+
@_builtins.property
|
|
1008
1007
|
@pulumi.getter(name="convergentEncryption")
|
|
1009
|
-
def convergent_encryption(self) -> pulumi.Output[Optional[
|
|
1008
|
+
def convergent_encryption(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1010
1009
|
"""
|
|
1011
1010
|
Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
1012
1011
|
"""
|
|
1013
1012
|
return pulumi.get(self, "convergent_encryption")
|
|
1014
1013
|
|
|
1015
|
-
@property
|
|
1014
|
+
@_builtins.property
|
|
1016
1015
|
@pulumi.getter(name="deletionAllowed")
|
|
1017
|
-
def deletion_allowed(self) -> pulumi.Output[Optional[
|
|
1016
|
+
def deletion_allowed(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1018
1017
|
"""
|
|
1019
1018
|
Specifies if the key is allowed to be deleted.
|
|
1020
1019
|
"""
|
|
1021
1020
|
return pulumi.get(self, "deletion_allowed")
|
|
1022
1021
|
|
|
1023
|
-
@property
|
|
1022
|
+
@_builtins.property
|
|
1024
1023
|
@pulumi.getter
|
|
1025
|
-
def derived(self) -> pulumi.Output[Optional[
|
|
1024
|
+
def derived(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1026
1025
|
"""
|
|
1027
1026
|
Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
1028
1027
|
"""
|
|
1029
1028
|
return pulumi.get(self, "derived")
|
|
1030
1029
|
|
|
1031
|
-
@property
|
|
1030
|
+
@_builtins.property
|
|
1032
1031
|
@pulumi.getter
|
|
1033
|
-
def exportable(self) -> pulumi.Output[Optional[
|
|
1032
|
+
def exportable(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1034
1033
|
"""
|
|
1035
1034
|
Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
1036
1035
|
"""
|
|
1037
1036
|
return pulumi.get(self, "exportable")
|
|
1038
1037
|
|
|
1039
|
-
@property
|
|
1038
|
+
@_builtins.property
|
|
1040
1039
|
@pulumi.getter(name="hybridKeyTypeEc")
|
|
1041
|
-
def hybrid_key_type_ec(self) -> pulumi.Output[Optional[
|
|
1040
|
+
def hybrid_key_type_ec(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1042
1041
|
"""
|
|
1043
1042
|
The elliptic curve algorithm to use for hybrid signatures.
|
|
1044
1043
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
1045
1044
|
"""
|
|
1046
1045
|
return pulumi.get(self, "hybrid_key_type_ec")
|
|
1047
1046
|
|
|
1048
|
-
@property
|
|
1047
|
+
@_builtins.property
|
|
1049
1048
|
@pulumi.getter(name="hybridKeyTypePqc")
|
|
1050
|
-
def hybrid_key_type_pqc(self) -> pulumi.Output[Optional[
|
|
1049
|
+
def hybrid_key_type_pqc(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1051
1050
|
"""
|
|
1052
1051
|
The post-quantum algorithm to use for hybrid signatures.
|
|
1053
1052
|
Currently, ML-DSA is the only supported key type.
|
|
1054
1053
|
"""
|
|
1055
1054
|
return pulumi.get(self, "hybrid_key_type_pqc")
|
|
1056
1055
|
|
|
1057
|
-
@property
|
|
1056
|
+
@_builtins.property
|
|
1058
1057
|
@pulumi.getter(name="keySize")
|
|
1059
|
-
def key_size(self) -> pulumi.Output[Optional[
|
|
1058
|
+
def key_size(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1060
1059
|
"""
|
|
1061
1060
|
The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
1062
1061
|
"""
|
|
1063
1062
|
return pulumi.get(self, "key_size")
|
|
1064
1063
|
|
|
1065
|
-
@property
|
|
1064
|
+
@_builtins.property
|
|
1066
1065
|
@pulumi.getter
|
|
1067
|
-
def keys(self) -> pulumi.Output[Sequence[Mapping[str,
|
|
1066
|
+
def keys(self) -> pulumi.Output[Sequence[Mapping[str, _builtins.str]]]:
|
|
1068
1067
|
"""
|
|
1069
1068
|
List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
|
|
1070
1069
|
* for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
|
|
@@ -1072,49 +1071,49 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
1072
1071
|
"""
|
|
1073
1072
|
return pulumi.get(self, "keys")
|
|
1074
1073
|
|
|
1075
|
-
@property
|
|
1074
|
+
@_builtins.property
|
|
1076
1075
|
@pulumi.getter(name="latestVersion")
|
|
1077
|
-
def latest_version(self) -> pulumi.Output[
|
|
1076
|
+
def latest_version(self) -> pulumi.Output[_builtins.int]:
|
|
1078
1077
|
"""
|
|
1079
1078
|
Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
|
|
1080
1079
|
"""
|
|
1081
1080
|
return pulumi.get(self, "latest_version")
|
|
1082
1081
|
|
|
1083
|
-
@property
|
|
1082
|
+
@_builtins.property
|
|
1084
1083
|
@pulumi.getter(name="minAvailableVersion")
|
|
1085
|
-
def min_available_version(self) -> pulumi.Output[
|
|
1084
|
+
def min_available_version(self) -> pulumi.Output[_builtins.int]:
|
|
1086
1085
|
"""
|
|
1087
1086
|
Minimum key version available for use. If keys have been archived by increasing `min_decryption_version`, this attribute will reflect that change.
|
|
1088
1087
|
"""
|
|
1089
1088
|
return pulumi.get(self, "min_available_version")
|
|
1090
1089
|
|
|
1091
|
-
@property
|
|
1090
|
+
@_builtins.property
|
|
1092
1091
|
@pulumi.getter(name="minDecryptionVersion")
|
|
1093
|
-
def min_decryption_version(self) -> pulumi.Output[Optional[
|
|
1092
|
+
def min_decryption_version(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1094
1093
|
"""
|
|
1095
1094
|
Minimum key version to use for decryption.
|
|
1096
1095
|
"""
|
|
1097
1096
|
return pulumi.get(self, "min_decryption_version")
|
|
1098
1097
|
|
|
1099
|
-
@property
|
|
1098
|
+
@_builtins.property
|
|
1100
1099
|
@pulumi.getter(name="minEncryptionVersion")
|
|
1101
|
-
def min_encryption_version(self) -> pulumi.Output[Optional[
|
|
1100
|
+
def min_encryption_version(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1102
1101
|
"""
|
|
1103
1102
|
Minimum key version to use for encryption
|
|
1104
1103
|
"""
|
|
1105
1104
|
return pulumi.get(self, "min_encryption_version")
|
|
1106
1105
|
|
|
1107
|
-
@property
|
|
1106
|
+
@_builtins.property
|
|
1108
1107
|
@pulumi.getter
|
|
1109
|
-
def name(self) -> pulumi.Output[
|
|
1108
|
+
def name(self) -> pulumi.Output[_builtins.str]:
|
|
1110
1109
|
"""
|
|
1111
1110
|
The name to identify this key within the backend. Must be unique within the backend.
|
|
1112
1111
|
"""
|
|
1113
1112
|
return pulumi.get(self, "name")
|
|
1114
1113
|
|
|
1115
|
-
@property
|
|
1114
|
+
@_builtins.property
|
|
1116
1115
|
@pulumi.getter
|
|
1117
|
-
def namespace(self) -> pulumi.Output[Optional[
|
|
1116
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1118
1117
|
"""
|
|
1119
1118
|
The namespace to provision the resource in.
|
|
1120
1119
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -1123,50 +1122,50 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
1123
1122
|
"""
|
|
1124
1123
|
return pulumi.get(self, "namespace")
|
|
1125
1124
|
|
|
1126
|
-
@property
|
|
1125
|
+
@_builtins.property
|
|
1127
1126
|
@pulumi.getter(name="parameterSet")
|
|
1128
|
-
def parameter_set(self) -> pulumi.Output[Optional[
|
|
1127
|
+
def parameter_set(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1129
1128
|
"""
|
|
1130
1129
|
The parameter set to use for ML-DSA. Required for
|
|
1131
1130
|
ML-DSA and hybrid keys. Valid values are `44`, `65`, and `87`.
|
|
1132
1131
|
"""
|
|
1133
1132
|
return pulumi.get(self, "parameter_set")
|
|
1134
1133
|
|
|
1135
|
-
@property
|
|
1134
|
+
@_builtins.property
|
|
1136
1135
|
@pulumi.getter(name="supportsDecryption")
|
|
1137
|
-
def supports_decryption(self) -> pulumi.Output[
|
|
1136
|
+
def supports_decryption(self) -> pulumi.Output[_builtins.bool]:
|
|
1138
1137
|
"""
|
|
1139
1138
|
Whether or not the key supports decryption, based on key type.
|
|
1140
1139
|
"""
|
|
1141
1140
|
return pulumi.get(self, "supports_decryption")
|
|
1142
1141
|
|
|
1143
|
-
@property
|
|
1142
|
+
@_builtins.property
|
|
1144
1143
|
@pulumi.getter(name="supportsDerivation")
|
|
1145
|
-
def supports_derivation(self) -> pulumi.Output[
|
|
1144
|
+
def supports_derivation(self) -> pulumi.Output[_builtins.bool]:
|
|
1146
1145
|
"""
|
|
1147
1146
|
Whether or not the key supports derivation, based on key type.
|
|
1148
1147
|
"""
|
|
1149
1148
|
return pulumi.get(self, "supports_derivation")
|
|
1150
1149
|
|
|
1151
|
-
@property
|
|
1150
|
+
@_builtins.property
|
|
1152
1151
|
@pulumi.getter(name="supportsEncryption")
|
|
1153
|
-
def supports_encryption(self) -> pulumi.Output[
|
|
1152
|
+
def supports_encryption(self) -> pulumi.Output[_builtins.bool]:
|
|
1154
1153
|
"""
|
|
1155
1154
|
Whether or not the key supports encryption, based on key type.
|
|
1156
1155
|
"""
|
|
1157
1156
|
return pulumi.get(self, "supports_encryption")
|
|
1158
1157
|
|
|
1159
|
-
@property
|
|
1158
|
+
@_builtins.property
|
|
1160
1159
|
@pulumi.getter(name="supportsSigning")
|
|
1161
|
-
def supports_signing(self) -> pulumi.Output[
|
|
1160
|
+
def supports_signing(self) -> pulumi.Output[_builtins.bool]:
|
|
1162
1161
|
"""
|
|
1163
1162
|
Whether or not the key supports signing, based on key type.
|
|
1164
1163
|
"""
|
|
1165
1164
|
return pulumi.get(self, "supports_signing")
|
|
1166
1165
|
|
|
1167
|
-
@property
|
|
1166
|
+
@_builtins.property
|
|
1168
1167
|
@pulumi.getter
|
|
1169
|
-
def type(self) -> pulumi.Output[Optional[
|
|
1168
|
+
def type(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1170
1169
|
"""
|
|
1171
1170
|
Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `rsa-4096`.
|
|
1172
1171
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|