pulumi-vault 7.2.0a1755297899__py3-none-any.whl → 7.2.0a1755574606__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +18 -0
- pulumi_vault/_inputs.py +201 -0
- pulumi_vault/aws/secret_backend.py +627 -49
- pulumi_vault/azure/backend.py +788 -15
- pulumi_vault/consul/secret_backend.py +660 -28
- pulumi_vault/database/secrets_mount.py +47 -0
- pulumi_vault/gcp/secret_backend.py +599 -56
- pulumi_vault/jwt/auth_backend.py +47 -0
- pulumi_vault/kmip/secret_backend.py +787 -7
- pulumi_vault/kubernetes/secret_backend.py +47 -0
- pulumi_vault/ldap/secret_backend.py +75 -35
- pulumi_vault/mount.py +47 -0
- pulumi_vault/nomad_secret_backend.py +660 -21
- pulumi_vault/oci_auth_backend.py +683 -0
- pulumi_vault/oci_auth_backend_role.py +798 -0
- pulumi_vault/outputs.py +153 -0
- pulumi_vault/pkisecret/backend_config_scep.py +68 -21
- pulumi_vault/pkisecret/get_backend_config_scep.py +21 -1
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/rabbitmq/secret_backend.py +707 -35
- pulumi_vault/ssh/secret_backend_ca.py +101 -7
- pulumi_vault/terraformcloud/secret_backend.py +707 -28
- pulumi_vault/transit/secret_backend_key.py +49 -21
- {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.2.0a1755574606.dist-info}/METADATA +1 -1
- {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.2.0a1755574606.dist-info}/RECORD +27 -25
- {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.2.0a1755574606.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.2.0a1755574606.dist-info}/top_level.txt +0 -0
|
@@ -19,49 +19,69 @@ __all__ = ['SecretBackendArgs', 'SecretBackend']
|
|
|
19
19
|
@pulumi.input_type
|
|
20
20
|
class SecretBackendArgs:
|
|
21
21
|
def __init__(__self__, *,
|
|
22
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
23
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
24
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
25
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
22
26
|
credentials: Optional[pulumi.Input[_builtins.str]] = None,
|
|
23
27
|
credentials_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
24
28
|
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
29
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
25
30
|
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
26
31
|
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
27
32
|
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
33
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
34
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
28
35
|
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
29
36
|
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
37
|
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
38
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
39
|
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
32
40
|
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
33
41
|
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
42
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
43
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
34
44
|
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
45
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
46
|
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
36
47
|
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
48
|
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
49
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
38
50
|
service_account_email: Optional[pulumi.Input[_builtins.str]] = None):
|
|
39
51
|
"""
|
|
40
52
|
The set of arguments for constructing a SecretBackend resource.
|
|
53
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
54
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
55
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
56
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
41
57
|
:param pulumi.Input[_builtins.str] credentials: JSON-encoded credentials to use to connect to GCP
|
|
42
58
|
:param pulumi.Input[_builtins.int] credentials_wo_version: The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
43
|
-
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds:
|
|
44
|
-
|
|
45
|
-
:param pulumi.Input[_builtins.str] description:
|
|
59
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
60
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
61
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
46
62
|
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
47
63
|
*Available only for Vault Enterprise*.
|
|
48
64
|
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
49
65
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
66
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
67
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
50
68
|
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value for plugin identity
|
|
51
69
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
52
70
|
Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
53
|
-
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing
|
|
54
|
-
tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
71
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
55
72
|
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated tokens.
|
|
56
|
-
:param pulumi.Input[_builtins.
|
|
57
|
-
:param pulumi.Input[_builtins.
|
|
58
|
-
|
|
73
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
74
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
75
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
59
76
|
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
60
77
|
The value should not contain leading or trailing forward slashes.
|
|
61
78
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
62
79
|
*Available only for Vault Enterprise*.
|
|
80
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
81
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
63
82
|
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
64
83
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
84
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
65
85
|
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
66
86
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
67
87
|
*Available only for Vault Enterprise*.
|
|
@@ -70,44 +90,117 @@ class SecretBackendArgs:
|
|
|
70
90
|
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
71
91
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
72
92
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
93
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
73
94
|
:param pulumi.Input[_builtins.str] service_account_email: Service Account to impersonate for plugin workload identity federation.
|
|
74
95
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
75
96
|
"""
|
|
97
|
+
if allowed_managed_keys is not None:
|
|
98
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
99
|
+
if allowed_response_headers is not None:
|
|
100
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
101
|
+
if audit_non_hmac_request_keys is not None:
|
|
102
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
103
|
+
if audit_non_hmac_response_keys is not None:
|
|
104
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
76
105
|
if credentials is not None:
|
|
77
106
|
pulumi.set(__self__, "credentials", credentials)
|
|
78
107
|
if credentials_wo_version is not None:
|
|
79
108
|
pulumi.set(__self__, "credentials_wo_version", credentials_wo_version)
|
|
80
109
|
if default_lease_ttl_seconds is not None:
|
|
81
110
|
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
111
|
+
if delegated_auth_accessors is not None:
|
|
112
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
82
113
|
if description is not None:
|
|
83
114
|
pulumi.set(__self__, "description", description)
|
|
84
115
|
if disable_automated_rotation is not None:
|
|
85
116
|
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
86
117
|
if disable_remount is not None:
|
|
87
118
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
119
|
+
if external_entropy_access is not None:
|
|
120
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
121
|
+
if force_no_cache is not None:
|
|
122
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
88
123
|
if identity_token_audience is not None:
|
|
89
124
|
pulumi.set(__self__, "identity_token_audience", identity_token_audience)
|
|
90
125
|
if identity_token_key is not None:
|
|
91
126
|
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
92
127
|
if identity_token_ttl is not None:
|
|
93
128
|
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
129
|
+
if listing_visibility is not None:
|
|
130
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
94
131
|
if local is not None:
|
|
95
132
|
pulumi.set(__self__, "local", local)
|
|
96
133
|
if max_lease_ttl_seconds is not None:
|
|
97
134
|
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
98
135
|
if namespace is not None:
|
|
99
136
|
pulumi.set(__self__, "namespace", namespace)
|
|
137
|
+
if options is not None:
|
|
138
|
+
pulumi.set(__self__, "options", options)
|
|
139
|
+
if passthrough_request_headers is not None:
|
|
140
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
100
141
|
if path is not None:
|
|
101
142
|
pulumi.set(__self__, "path", path)
|
|
143
|
+
if plugin_version is not None:
|
|
144
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
102
145
|
if rotation_period is not None:
|
|
103
146
|
pulumi.set(__self__, "rotation_period", rotation_period)
|
|
104
147
|
if rotation_schedule is not None:
|
|
105
148
|
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
106
149
|
if rotation_window is not None:
|
|
107
150
|
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
151
|
+
if seal_wrap is not None:
|
|
152
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
108
153
|
if service_account_email is not None:
|
|
109
154
|
pulumi.set(__self__, "service_account_email", service_account_email)
|
|
110
155
|
|
|
156
|
+
@_builtins.property
|
|
157
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
158
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
159
|
+
"""
|
|
160
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
161
|
+
"""
|
|
162
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
163
|
+
|
|
164
|
+
@allowed_managed_keys.setter
|
|
165
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
166
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
167
|
+
|
|
168
|
+
@_builtins.property
|
|
169
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
170
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
171
|
+
"""
|
|
172
|
+
List of headers to allow and pass from the request to the plugin
|
|
173
|
+
"""
|
|
174
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
175
|
+
|
|
176
|
+
@allowed_response_headers.setter
|
|
177
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
178
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
179
|
+
|
|
180
|
+
@_builtins.property
|
|
181
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
182
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
183
|
+
"""
|
|
184
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
185
|
+
"""
|
|
186
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
187
|
+
|
|
188
|
+
@audit_non_hmac_request_keys.setter
|
|
189
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
190
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
191
|
+
|
|
192
|
+
@_builtins.property
|
|
193
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
194
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
195
|
+
"""
|
|
196
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
197
|
+
"""
|
|
198
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
199
|
+
|
|
200
|
+
@audit_non_hmac_response_keys.setter
|
|
201
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
202
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
203
|
+
|
|
111
204
|
@_builtins.property
|
|
112
205
|
@pulumi.getter
|
|
113
206
|
def credentials(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -136,8 +229,7 @@ class SecretBackendArgs:
|
|
|
136
229
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
137
230
|
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
138
231
|
"""
|
|
139
|
-
|
|
140
|
-
issued by this backend. Defaults to '0'.
|
|
232
|
+
Default lease duration for secrets in seconds
|
|
141
233
|
"""
|
|
142
234
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
143
235
|
|
|
@@ -145,11 +237,23 @@ class SecretBackendArgs:
|
|
|
145
237
|
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
146
238
|
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
147
239
|
|
|
240
|
+
@_builtins.property
|
|
241
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
242
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
243
|
+
"""
|
|
244
|
+
List of headers to allow and pass from the request to the plugin
|
|
245
|
+
"""
|
|
246
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
247
|
+
|
|
248
|
+
@delegated_auth_accessors.setter
|
|
249
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
250
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
251
|
+
|
|
148
252
|
@_builtins.property
|
|
149
253
|
@pulumi.getter
|
|
150
254
|
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
151
255
|
"""
|
|
152
|
-
|
|
256
|
+
Human-friendly description of the mount for the backend.
|
|
153
257
|
"""
|
|
154
258
|
return pulumi.get(self, "description")
|
|
155
259
|
|
|
@@ -183,6 +287,30 @@ class SecretBackendArgs:
|
|
|
183
287
|
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
184
288
|
pulumi.set(self, "disable_remount", value)
|
|
185
289
|
|
|
290
|
+
@_builtins.property
|
|
291
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
292
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
293
|
+
"""
|
|
294
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
295
|
+
"""
|
|
296
|
+
return pulumi.get(self, "external_entropy_access")
|
|
297
|
+
|
|
298
|
+
@external_entropy_access.setter
|
|
299
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
300
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
301
|
+
|
|
302
|
+
@_builtins.property
|
|
303
|
+
@pulumi.getter(name="forceNoCache")
|
|
304
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
305
|
+
"""
|
|
306
|
+
If set to true, disables caching.
|
|
307
|
+
"""
|
|
308
|
+
return pulumi.get(self, "force_no_cache")
|
|
309
|
+
|
|
310
|
+
@force_no_cache.setter
|
|
311
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
312
|
+
pulumi.set(self, "force_no_cache", value)
|
|
313
|
+
|
|
186
314
|
@_builtins.property
|
|
187
315
|
@pulumi.getter(name="identityTokenAudience")
|
|
188
316
|
def identity_token_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -201,8 +329,7 @@ class SecretBackendArgs:
|
|
|
201
329
|
@pulumi.getter(name="identityTokenKey")
|
|
202
330
|
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
203
331
|
"""
|
|
204
|
-
The key to use for signing
|
|
205
|
-
tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
332
|
+
The key to use for signing identity tokens.
|
|
206
333
|
"""
|
|
207
334
|
return pulumi.get(self, "identity_token_key")
|
|
208
335
|
|
|
@@ -222,11 +349,23 @@ class SecretBackendArgs:
|
|
|
222
349
|
def identity_token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
223
350
|
pulumi.set(self, "identity_token_ttl", value)
|
|
224
351
|
|
|
352
|
+
@_builtins.property
|
|
353
|
+
@pulumi.getter(name="listingVisibility")
|
|
354
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
355
|
+
"""
|
|
356
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
357
|
+
"""
|
|
358
|
+
return pulumi.get(self, "listing_visibility")
|
|
359
|
+
|
|
360
|
+
@listing_visibility.setter
|
|
361
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
362
|
+
pulumi.set(self, "listing_visibility", value)
|
|
363
|
+
|
|
225
364
|
@_builtins.property
|
|
226
365
|
@pulumi.getter
|
|
227
366
|
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
228
367
|
"""
|
|
229
|
-
|
|
368
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
230
369
|
"""
|
|
231
370
|
return pulumi.get(self, "local")
|
|
232
371
|
|
|
@@ -238,8 +377,7 @@ class SecretBackendArgs:
|
|
|
238
377
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
239
378
|
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
240
379
|
"""
|
|
241
|
-
|
|
242
|
-
for credentials issued by this backend. Defaults to '0'.
|
|
380
|
+
Maximum possible lease duration for secrets in seconds
|
|
243
381
|
"""
|
|
244
382
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
245
383
|
|
|
@@ -262,6 +400,30 @@ class SecretBackendArgs:
|
|
|
262
400
|
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
263
401
|
pulumi.set(self, "namespace", value)
|
|
264
402
|
|
|
403
|
+
@_builtins.property
|
|
404
|
+
@pulumi.getter
|
|
405
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
406
|
+
"""
|
|
407
|
+
Specifies mount type specific options that are passed to the backend
|
|
408
|
+
"""
|
|
409
|
+
return pulumi.get(self, "options")
|
|
410
|
+
|
|
411
|
+
@options.setter
|
|
412
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
413
|
+
pulumi.set(self, "options", value)
|
|
414
|
+
|
|
415
|
+
@_builtins.property
|
|
416
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
417
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
418
|
+
"""
|
|
419
|
+
List of headers to allow and pass from the request to the plugin
|
|
420
|
+
"""
|
|
421
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
422
|
+
|
|
423
|
+
@passthrough_request_headers.setter
|
|
424
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
425
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
426
|
+
|
|
265
427
|
@_builtins.property
|
|
266
428
|
@pulumi.getter
|
|
267
429
|
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -275,6 +437,18 @@ class SecretBackendArgs:
|
|
|
275
437
|
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
276
438
|
pulumi.set(self, "path", value)
|
|
277
439
|
|
|
440
|
+
@_builtins.property
|
|
441
|
+
@pulumi.getter(name="pluginVersion")
|
|
442
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
443
|
+
"""
|
|
444
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
445
|
+
"""
|
|
446
|
+
return pulumi.get(self, "plugin_version")
|
|
447
|
+
|
|
448
|
+
@plugin_version.setter
|
|
449
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
450
|
+
pulumi.set(self, "plugin_version", value)
|
|
451
|
+
|
|
278
452
|
@_builtins.property
|
|
279
453
|
@pulumi.getter(name="rotationPeriod")
|
|
280
454
|
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
@@ -316,6 +490,18 @@ class SecretBackendArgs:
|
|
|
316
490
|
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
317
491
|
pulumi.set(self, "rotation_window", value)
|
|
318
492
|
|
|
493
|
+
@_builtins.property
|
|
494
|
+
@pulumi.getter(name="sealWrap")
|
|
495
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
496
|
+
"""
|
|
497
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
498
|
+
"""
|
|
499
|
+
return pulumi.get(self, "seal_wrap")
|
|
500
|
+
|
|
501
|
+
@seal_wrap.setter
|
|
502
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
503
|
+
pulumi.set(self, "seal_wrap", value)
|
|
504
|
+
|
|
319
505
|
@_builtins.property
|
|
320
506
|
@pulumi.getter(name="serviceAccountEmail")
|
|
321
507
|
def service_account_email(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -334,50 +520,70 @@ class SecretBackendArgs:
|
|
|
334
520
|
class _SecretBackendState:
|
|
335
521
|
def __init__(__self__, *,
|
|
336
522
|
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
523
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
524
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
525
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
526
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
337
527
|
credentials: Optional[pulumi.Input[_builtins.str]] = None,
|
|
338
528
|
credentials_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
339
529
|
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
530
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
340
531
|
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
341
532
|
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
342
533
|
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
534
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
535
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
343
536
|
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
344
537
|
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
345
538
|
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
539
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
346
540
|
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
347
541
|
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
348
542
|
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
543
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
544
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
349
545
|
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
546
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
350
547
|
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
351
548
|
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
352
549
|
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
550
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
353
551
|
service_account_email: Optional[pulumi.Input[_builtins.str]] = None):
|
|
354
552
|
"""
|
|
355
553
|
Input properties used for looking up and filtering SecretBackend resources.
|
|
356
554
|
:param pulumi.Input[_builtins.str] accessor: The accessor of the created GCP mount.
|
|
555
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
556
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
557
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
558
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
357
559
|
:param pulumi.Input[_builtins.str] credentials: JSON-encoded credentials to use to connect to GCP
|
|
358
560
|
:param pulumi.Input[_builtins.int] credentials_wo_version: The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
359
|
-
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds:
|
|
360
|
-
|
|
361
|
-
:param pulumi.Input[_builtins.str] description:
|
|
561
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
562
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
563
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
362
564
|
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
363
565
|
*Available only for Vault Enterprise*.
|
|
364
566
|
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
365
567
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
568
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
569
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
366
570
|
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value for plugin identity
|
|
367
571
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
368
572
|
Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
369
|
-
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing
|
|
370
|
-
tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
573
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
371
574
|
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated tokens.
|
|
372
|
-
:param pulumi.Input[_builtins.
|
|
373
|
-
:param pulumi.Input[_builtins.
|
|
374
|
-
|
|
575
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
576
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
577
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
375
578
|
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
376
579
|
The value should not contain leading or trailing forward slashes.
|
|
377
580
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
378
581
|
*Available only for Vault Enterprise*.
|
|
582
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
583
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
379
584
|
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
380
585
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
586
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
381
587
|
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
382
588
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
383
589
|
*Available only for Vault Enterprise*.
|
|
@@ -386,43 +592,68 @@ class _SecretBackendState:
|
|
|
386
592
|
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
387
593
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
388
594
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
595
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
389
596
|
:param pulumi.Input[_builtins.str] service_account_email: Service Account to impersonate for plugin workload identity federation.
|
|
390
597
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
391
598
|
"""
|
|
392
599
|
if accessor is not None:
|
|
393
600
|
pulumi.set(__self__, "accessor", accessor)
|
|
601
|
+
if allowed_managed_keys is not None:
|
|
602
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
603
|
+
if allowed_response_headers is not None:
|
|
604
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
605
|
+
if audit_non_hmac_request_keys is not None:
|
|
606
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
607
|
+
if audit_non_hmac_response_keys is not None:
|
|
608
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
394
609
|
if credentials is not None:
|
|
395
610
|
pulumi.set(__self__, "credentials", credentials)
|
|
396
611
|
if credentials_wo_version is not None:
|
|
397
612
|
pulumi.set(__self__, "credentials_wo_version", credentials_wo_version)
|
|
398
613
|
if default_lease_ttl_seconds is not None:
|
|
399
614
|
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
615
|
+
if delegated_auth_accessors is not None:
|
|
616
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
400
617
|
if description is not None:
|
|
401
618
|
pulumi.set(__self__, "description", description)
|
|
402
619
|
if disable_automated_rotation is not None:
|
|
403
620
|
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
404
621
|
if disable_remount is not None:
|
|
405
622
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
623
|
+
if external_entropy_access is not None:
|
|
624
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
625
|
+
if force_no_cache is not None:
|
|
626
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
406
627
|
if identity_token_audience is not None:
|
|
407
628
|
pulumi.set(__self__, "identity_token_audience", identity_token_audience)
|
|
408
629
|
if identity_token_key is not None:
|
|
409
630
|
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
410
631
|
if identity_token_ttl is not None:
|
|
411
632
|
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
633
|
+
if listing_visibility is not None:
|
|
634
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
412
635
|
if local is not None:
|
|
413
636
|
pulumi.set(__self__, "local", local)
|
|
414
637
|
if max_lease_ttl_seconds is not None:
|
|
415
638
|
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
416
639
|
if namespace is not None:
|
|
417
640
|
pulumi.set(__self__, "namespace", namespace)
|
|
641
|
+
if options is not None:
|
|
642
|
+
pulumi.set(__self__, "options", options)
|
|
643
|
+
if passthrough_request_headers is not None:
|
|
644
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
418
645
|
if path is not None:
|
|
419
646
|
pulumi.set(__self__, "path", path)
|
|
647
|
+
if plugin_version is not None:
|
|
648
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
420
649
|
if rotation_period is not None:
|
|
421
650
|
pulumi.set(__self__, "rotation_period", rotation_period)
|
|
422
651
|
if rotation_schedule is not None:
|
|
423
652
|
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
424
653
|
if rotation_window is not None:
|
|
425
654
|
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
655
|
+
if seal_wrap is not None:
|
|
656
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
426
657
|
if service_account_email is not None:
|
|
427
658
|
pulumi.set(__self__, "service_account_email", service_account_email)
|
|
428
659
|
|
|
@@ -438,6 +669,54 @@ class _SecretBackendState:
|
|
|
438
669
|
def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
439
670
|
pulumi.set(self, "accessor", value)
|
|
440
671
|
|
|
672
|
+
@_builtins.property
|
|
673
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
674
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
675
|
+
"""
|
|
676
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
677
|
+
"""
|
|
678
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
679
|
+
|
|
680
|
+
@allowed_managed_keys.setter
|
|
681
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
682
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
683
|
+
|
|
684
|
+
@_builtins.property
|
|
685
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
686
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
687
|
+
"""
|
|
688
|
+
List of headers to allow and pass from the request to the plugin
|
|
689
|
+
"""
|
|
690
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
691
|
+
|
|
692
|
+
@allowed_response_headers.setter
|
|
693
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
694
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
695
|
+
|
|
696
|
+
@_builtins.property
|
|
697
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
698
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
699
|
+
"""
|
|
700
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
701
|
+
"""
|
|
702
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
703
|
+
|
|
704
|
+
@audit_non_hmac_request_keys.setter
|
|
705
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
706
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
707
|
+
|
|
708
|
+
@_builtins.property
|
|
709
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
710
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
711
|
+
"""
|
|
712
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
713
|
+
"""
|
|
714
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
715
|
+
|
|
716
|
+
@audit_non_hmac_response_keys.setter
|
|
717
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
718
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
719
|
+
|
|
441
720
|
@_builtins.property
|
|
442
721
|
@pulumi.getter
|
|
443
722
|
def credentials(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -466,8 +745,7 @@ class _SecretBackendState:
|
|
|
466
745
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
467
746
|
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
468
747
|
"""
|
|
469
|
-
|
|
470
|
-
issued by this backend. Defaults to '0'.
|
|
748
|
+
Default lease duration for secrets in seconds
|
|
471
749
|
"""
|
|
472
750
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
473
751
|
|
|
@@ -475,11 +753,23 @@ class _SecretBackendState:
|
|
|
475
753
|
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
476
754
|
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
477
755
|
|
|
756
|
+
@_builtins.property
|
|
757
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
758
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
759
|
+
"""
|
|
760
|
+
List of headers to allow and pass from the request to the plugin
|
|
761
|
+
"""
|
|
762
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
763
|
+
|
|
764
|
+
@delegated_auth_accessors.setter
|
|
765
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
766
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
767
|
+
|
|
478
768
|
@_builtins.property
|
|
479
769
|
@pulumi.getter
|
|
480
770
|
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
481
771
|
"""
|
|
482
|
-
|
|
772
|
+
Human-friendly description of the mount for the backend.
|
|
483
773
|
"""
|
|
484
774
|
return pulumi.get(self, "description")
|
|
485
775
|
|
|
@@ -513,6 +803,30 @@ class _SecretBackendState:
|
|
|
513
803
|
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
514
804
|
pulumi.set(self, "disable_remount", value)
|
|
515
805
|
|
|
806
|
+
@_builtins.property
|
|
807
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
808
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
809
|
+
"""
|
|
810
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
811
|
+
"""
|
|
812
|
+
return pulumi.get(self, "external_entropy_access")
|
|
813
|
+
|
|
814
|
+
@external_entropy_access.setter
|
|
815
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
816
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
817
|
+
|
|
818
|
+
@_builtins.property
|
|
819
|
+
@pulumi.getter(name="forceNoCache")
|
|
820
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
821
|
+
"""
|
|
822
|
+
If set to true, disables caching.
|
|
823
|
+
"""
|
|
824
|
+
return pulumi.get(self, "force_no_cache")
|
|
825
|
+
|
|
826
|
+
@force_no_cache.setter
|
|
827
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
828
|
+
pulumi.set(self, "force_no_cache", value)
|
|
829
|
+
|
|
516
830
|
@_builtins.property
|
|
517
831
|
@pulumi.getter(name="identityTokenAudience")
|
|
518
832
|
def identity_token_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -531,8 +845,7 @@ class _SecretBackendState:
|
|
|
531
845
|
@pulumi.getter(name="identityTokenKey")
|
|
532
846
|
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
533
847
|
"""
|
|
534
|
-
The key to use for signing
|
|
535
|
-
tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
848
|
+
The key to use for signing identity tokens.
|
|
536
849
|
"""
|
|
537
850
|
return pulumi.get(self, "identity_token_key")
|
|
538
851
|
|
|
@@ -552,11 +865,23 @@ class _SecretBackendState:
|
|
|
552
865
|
def identity_token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
553
866
|
pulumi.set(self, "identity_token_ttl", value)
|
|
554
867
|
|
|
868
|
+
@_builtins.property
|
|
869
|
+
@pulumi.getter(name="listingVisibility")
|
|
870
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
871
|
+
"""
|
|
872
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
873
|
+
"""
|
|
874
|
+
return pulumi.get(self, "listing_visibility")
|
|
875
|
+
|
|
876
|
+
@listing_visibility.setter
|
|
877
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
878
|
+
pulumi.set(self, "listing_visibility", value)
|
|
879
|
+
|
|
555
880
|
@_builtins.property
|
|
556
881
|
@pulumi.getter
|
|
557
882
|
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
558
883
|
"""
|
|
559
|
-
|
|
884
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
560
885
|
"""
|
|
561
886
|
return pulumi.get(self, "local")
|
|
562
887
|
|
|
@@ -568,8 +893,7 @@ class _SecretBackendState:
|
|
|
568
893
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
569
894
|
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
570
895
|
"""
|
|
571
|
-
|
|
572
|
-
for credentials issued by this backend. Defaults to '0'.
|
|
896
|
+
Maximum possible lease duration for secrets in seconds
|
|
573
897
|
"""
|
|
574
898
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
575
899
|
|
|
@@ -592,6 +916,30 @@ class _SecretBackendState:
|
|
|
592
916
|
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
593
917
|
pulumi.set(self, "namespace", value)
|
|
594
918
|
|
|
919
|
+
@_builtins.property
|
|
920
|
+
@pulumi.getter
|
|
921
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
922
|
+
"""
|
|
923
|
+
Specifies mount type specific options that are passed to the backend
|
|
924
|
+
"""
|
|
925
|
+
return pulumi.get(self, "options")
|
|
926
|
+
|
|
927
|
+
@options.setter
|
|
928
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
929
|
+
pulumi.set(self, "options", value)
|
|
930
|
+
|
|
931
|
+
@_builtins.property
|
|
932
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
933
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
934
|
+
"""
|
|
935
|
+
List of headers to allow and pass from the request to the plugin
|
|
936
|
+
"""
|
|
937
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
938
|
+
|
|
939
|
+
@passthrough_request_headers.setter
|
|
940
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
941
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
942
|
+
|
|
595
943
|
@_builtins.property
|
|
596
944
|
@pulumi.getter
|
|
597
945
|
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -605,6 +953,18 @@ class _SecretBackendState:
|
|
|
605
953
|
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
606
954
|
pulumi.set(self, "path", value)
|
|
607
955
|
|
|
956
|
+
@_builtins.property
|
|
957
|
+
@pulumi.getter(name="pluginVersion")
|
|
958
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
959
|
+
"""
|
|
960
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
961
|
+
"""
|
|
962
|
+
return pulumi.get(self, "plugin_version")
|
|
963
|
+
|
|
964
|
+
@plugin_version.setter
|
|
965
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
966
|
+
pulumi.set(self, "plugin_version", value)
|
|
967
|
+
|
|
608
968
|
@_builtins.property
|
|
609
969
|
@pulumi.getter(name="rotationPeriod")
|
|
610
970
|
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
@@ -646,6 +1006,18 @@ class _SecretBackendState:
|
|
|
646
1006
|
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
647
1007
|
pulumi.set(self, "rotation_window", value)
|
|
648
1008
|
|
|
1009
|
+
@_builtins.property
|
|
1010
|
+
@pulumi.getter(name="sealWrap")
|
|
1011
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1012
|
+
"""
|
|
1013
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1014
|
+
"""
|
|
1015
|
+
return pulumi.get(self, "seal_wrap")
|
|
1016
|
+
|
|
1017
|
+
@seal_wrap.setter
|
|
1018
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1019
|
+
pulumi.set(self, "seal_wrap", value)
|
|
1020
|
+
|
|
649
1021
|
@_builtins.property
|
|
650
1022
|
@pulumi.getter(name="serviceAccountEmail")
|
|
651
1023
|
def service_account_email(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -666,22 +1038,34 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
666
1038
|
def __init__(__self__,
|
|
667
1039
|
resource_name: str,
|
|
668
1040
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1041
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1042
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1043
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1044
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
669
1045
|
credentials: Optional[pulumi.Input[_builtins.str]] = None,
|
|
670
1046
|
credentials_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
671
1047
|
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1048
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
672
1049
|
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
673
1050
|
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
674
1051
|
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1052
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1053
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
675
1054
|
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
676
1055
|
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
677
1056
|
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1057
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
678
1058
|
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
679
1059
|
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
680
1060
|
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1061
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1062
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
681
1063
|
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1064
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
682
1065
|
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
683
1066
|
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
684
1067
|
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1068
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
685
1069
|
service_account_email: Optional[pulumi.Input[_builtins.str]] = None,
|
|
686
1070
|
__props__=None):
|
|
687
1071
|
"""
|
|
@@ -721,30 +1105,38 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
721
1105
|
|
|
722
1106
|
:param str resource_name: The name of the resource.
|
|
723
1107
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1108
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1109
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1110
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1111
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
724
1112
|
:param pulumi.Input[_builtins.str] credentials: JSON-encoded credentials to use to connect to GCP
|
|
725
1113
|
:param pulumi.Input[_builtins.int] credentials_wo_version: The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
726
|
-
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds:
|
|
727
|
-
|
|
728
|
-
:param pulumi.Input[_builtins.str] description:
|
|
1114
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
1115
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1116
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
729
1117
|
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
730
1118
|
*Available only for Vault Enterprise*.
|
|
731
1119
|
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
732
1120
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1121
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1122
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
733
1123
|
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value for plugin identity
|
|
734
1124
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
735
1125
|
Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
736
|
-
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing
|
|
737
|
-
tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
1126
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
738
1127
|
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated tokens.
|
|
739
|
-
:param pulumi.Input[_builtins.
|
|
740
|
-
:param pulumi.Input[_builtins.
|
|
741
|
-
|
|
1128
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1129
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1130
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
742
1131
|
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
743
1132
|
The value should not contain leading or trailing forward slashes.
|
|
744
1133
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
745
1134
|
*Available only for Vault Enterprise*.
|
|
1135
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1136
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
746
1137
|
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
747
1138
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
1139
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
748
1140
|
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
749
1141
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
750
1142
|
*Available only for Vault Enterprise*.
|
|
@@ -753,6 +1145,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
753
1145
|
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
754
1146
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
755
1147
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
1148
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
756
1149
|
:param pulumi.Input[_builtins.str] service_account_email: Service Account to impersonate for plugin workload identity federation.
|
|
757
1150
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
758
1151
|
"""
|
|
@@ -812,22 +1205,34 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
812
1205
|
def _internal_init(__self__,
|
|
813
1206
|
resource_name: str,
|
|
814
1207
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1208
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1209
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1210
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1211
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
815
1212
|
credentials: Optional[pulumi.Input[_builtins.str]] = None,
|
|
816
1213
|
credentials_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
817
1214
|
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1215
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
818
1216
|
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
819
1217
|
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
820
1218
|
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1219
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1220
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
821
1221
|
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
822
1222
|
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
823
1223
|
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1224
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
824
1225
|
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
825
1226
|
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
826
1227
|
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1228
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1229
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
827
1230
|
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1231
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
828
1232
|
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
829
1233
|
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
830
1234
|
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1235
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
831
1236
|
service_account_email: Optional[pulumi.Input[_builtins.str]] = None,
|
|
832
1237
|
__props__=None):
|
|
833
1238
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
@@ -838,22 +1243,34 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
838
1243
|
raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
|
|
839
1244
|
__props__ = SecretBackendArgs.__new__(SecretBackendArgs)
|
|
840
1245
|
|
|
1246
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1247
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1248
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1249
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
841
1250
|
__props__.__dict__["credentials"] = None if credentials is None else pulumi.Output.secret(credentials)
|
|
842
1251
|
__props__.__dict__["credentials_wo_version"] = credentials_wo_version
|
|
843
1252
|
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
1253
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
844
1254
|
__props__.__dict__["description"] = description
|
|
845
1255
|
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
846
1256
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1257
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1258
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
847
1259
|
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
848
1260
|
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
849
1261
|
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
1262
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
850
1263
|
__props__.__dict__["local"] = local
|
|
851
1264
|
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
852
1265
|
__props__.__dict__["namespace"] = namespace
|
|
1266
|
+
__props__.__dict__["options"] = options
|
|
1267
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
853
1268
|
__props__.__dict__["path"] = path
|
|
1269
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
854
1270
|
__props__.__dict__["rotation_period"] = rotation_period
|
|
855
1271
|
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
856
1272
|
__props__.__dict__["rotation_window"] = rotation_window
|
|
1273
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
857
1274
|
__props__.__dict__["service_account_email"] = service_account_email
|
|
858
1275
|
__props__.__dict__["accessor"] = None
|
|
859
1276
|
secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["credentials"])
|
|
@@ -869,22 +1286,34 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
869
1286
|
id: pulumi.Input[str],
|
|
870
1287
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
871
1288
|
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1289
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1290
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1291
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1292
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
872
1293
|
credentials: Optional[pulumi.Input[_builtins.str]] = None,
|
|
873
1294
|
credentials_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
874
1295
|
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1296
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
875
1297
|
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
876
1298
|
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
877
1299
|
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1300
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1301
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
878
1302
|
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
879
1303
|
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
880
1304
|
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1305
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
881
1306
|
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
882
1307
|
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
883
1308
|
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1309
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1310
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
884
1311
|
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1312
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
885
1313
|
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
886
1314
|
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
887
1315
|
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1316
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
888
1317
|
service_account_email: Optional[pulumi.Input[_builtins.str]] = None) -> 'SecretBackend':
|
|
889
1318
|
"""
|
|
890
1319
|
Get an existing SecretBackend resource's state with the given name, id, and optional extra
|
|
@@ -894,30 +1323,38 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
894
1323
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
895
1324
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
896
1325
|
:param pulumi.Input[_builtins.str] accessor: The accessor of the created GCP mount.
|
|
1326
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1327
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1328
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1329
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
897
1330
|
:param pulumi.Input[_builtins.str] credentials: JSON-encoded credentials to use to connect to GCP
|
|
898
1331
|
:param pulumi.Input[_builtins.int] credentials_wo_version: The version of the `credentials_wo`. For more info see updating write-only attributes.
|
|
899
|
-
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds:
|
|
900
|
-
|
|
901
|
-
:param pulumi.Input[_builtins.str] description:
|
|
1332
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
1333
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1334
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
902
1335
|
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
903
1336
|
*Available only for Vault Enterprise*.
|
|
904
1337
|
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
905
1338
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1339
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1340
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
906
1341
|
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value for plugin identity
|
|
907
1342
|
tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
|
|
908
1343
|
Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
909
|
-
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing
|
|
910
|
-
tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
1344
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
911
1345
|
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated tokens.
|
|
912
|
-
:param pulumi.Input[_builtins.
|
|
913
|
-
:param pulumi.Input[_builtins.
|
|
914
|
-
|
|
1346
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1347
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1348
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
915
1349
|
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
916
1350
|
The value should not contain leading or trailing forward slashes.
|
|
917
1351
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
918
1352
|
*Available only for Vault Enterprise*.
|
|
1353
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1354
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
919
1355
|
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
920
1356
|
not begin or end with a `/`. Defaults to `gcp`.
|
|
1357
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
921
1358
|
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
922
1359
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
923
1360
|
*Available only for Vault Enterprise*.
|
|
@@ -926,6 +1363,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
926
1363
|
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
927
1364
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
928
1365
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.
|
|
1366
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
929
1367
|
:param pulumi.Input[_builtins.str] service_account_email: Service Account to impersonate for plugin workload identity federation.
|
|
930
1368
|
Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
931
1369
|
"""
|
|
@@ -934,22 +1372,34 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
934
1372
|
__props__ = _SecretBackendState.__new__(_SecretBackendState)
|
|
935
1373
|
|
|
936
1374
|
__props__.__dict__["accessor"] = accessor
|
|
1375
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1376
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1377
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1378
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
937
1379
|
__props__.__dict__["credentials"] = credentials
|
|
938
1380
|
__props__.__dict__["credentials_wo_version"] = credentials_wo_version
|
|
939
1381
|
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
1382
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
940
1383
|
__props__.__dict__["description"] = description
|
|
941
1384
|
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
942
1385
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1386
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1387
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
943
1388
|
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
944
1389
|
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
945
1390
|
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
1391
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
946
1392
|
__props__.__dict__["local"] = local
|
|
947
1393
|
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
948
1394
|
__props__.__dict__["namespace"] = namespace
|
|
1395
|
+
__props__.__dict__["options"] = options
|
|
1396
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
949
1397
|
__props__.__dict__["path"] = path
|
|
1398
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
950
1399
|
__props__.__dict__["rotation_period"] = rotation_period
|
|
951
1400
|
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
952
1401
|
__props__.__dict__["rotation_window"] = rotation_window
|
|
1402
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
953
1403
|
__props__.__dict__["service_account_email"] = service_account_email
|
|
954
1404
|
return SecretBackend(resource_name, opts=opts, __props__=__props__)
|
|
955
1405
|
|
|
@@ -961,6 +1411,38 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
961
1411
|
"""
|
|
962
1412
|
return pulumi.get(self, "accessor")
|
|
963
1413
|
|
|
1414
|
+
@_builtins.property
|
|
1415
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
1416
|
+
def allowed_managed_keys(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1417
|
+
"""
|
|
1418
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
1419
|
+
"""
|
|
1420
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
1421
|
+
|
|
1422
|
+
@_builtins.property
|
|
1423
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
1424
|
+
def allowed_response_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1425
|
+
"""
|
|
1426
|
+
List of headers to allow and pass from the request to the plugin
|
|
1427
|
+
"""
|
|
1428
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
1429
|
+
|
|
1430
|
+
@_builtins.property
|
|
1431
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
1432
|
+
def audit_non_hmac_request_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1433
|
+
"""
|
|
1434
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1435
|
+
"""
|
|
1436
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
1437
|
+
|
|
1438
|
+
@_builtins.property
|
|
1439
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
1440
|
+
def audit_non_hmac_response_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1441
|
+
"""
|
|
1442
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1443
|
+
"""
|
|
1444
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
1445
|
+
|
|
964
1446
|
@_builtins.property
|
|
965
1447
|
@pulumi.getter
|
|
966
1448
|
def credentials(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
@@ -981,16 +1463,23 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
981
1463
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
982
1464
|
def default_lease_ttl_seconds(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
983
1465
|
"""
|
|
984
|
-
|
|
985
|
-
issued by this backend. Defaults to '0'.
|
|
1466
|
+
Default lease duration for secrets in seconds
|
|
986
1467
|
"""
|
|
987
1468
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
988
1469
|
|
|
1470
|
+
@_builtins.property
|
|
1471
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
1472
|
+
def delegated_auth_accessors(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1473
|
+
"""
|
|
1474
|
+
List of headers to allow and pass from the request to the plugin
|
|
1475
|
+
"""
|
|
1476
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
1477
|
+
|
|
989
1478
|
@_builtins.property
|
|
990
1479
|
@pulumi.getter
|
|
991
1480
|
def description(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
992
1481
|
"""
|
|
993
|
-
|
|
1482
|
+
Human-friendly description of the mount for the backend.
|
|
994
1483
|
"""
|
|
995
1484
|
return pulumi.get(self, "description")
|
|
996
1485
|
|
|
@@ -1012,6 +1501,22 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1012
1501
|
"""
|
|
1013
1502
|
return pulumi.get(self, "disable_remount")
|
|
1014
1503
|
|
|
1504
|
+
@_builtins.property
|
|
1505
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
1506
|
+
def external_entropy_access(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1507
|
+
"""
|
|
1508
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
1509
|
+
"""
|
|
1510
|
+
return pulumi.get(self, "external_entropy_access")
|
|
1511
|
+
|
|
1512
|
+
@_builtins.property
|
|
1513
|
+
@pulumi.getter(name="forceNoCache")
|
|
1514
|
+
def force_no_cache(self) -> pulumi.Output[_builtins.bool]:
|
|
1515
|
+
"""
|
|
1516
|
+
If set to true, disables caching.
|
|
1517
|
+
"""
|
|
1518
|
+
return pulumi.get(self, "force_no_cache")
|
|
1519
|
+
|
|
1015
1520
|
@_builtins.property
|
|
1016
1521
|
@pulumi.getter(name="identityTokenAudience")
|
|
1017
1522
|
def identity_token_audience(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
@@ -1026,8 +1531,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1026
1531
|
@pulumi.getter(name="identityTokenKey")
|
|
1027
1532
|
def identity_token_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1028
1533
|
"""
|
|
1029
|
-
The key to use for signing
|
|
1030
|
-
tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
|
|
1534
|
+
The key to use for signing identity tokens.
|
|
1031
1535
|
"""
|
|
1032
1536
|
return pulumi.get(self, "identity_token_key")
|
|
1033
1537
|
|
|
@@ -1039,11 +1543,19 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1039
1543
|
"""
|
|
1040
1544
|
return pulumi.get(self, "identity_token_ttl")
|
|
1041
1545
|
|
|
1546
|
+
@_builtins.property
|
|
1547
|
+
@pulumi.getter(name="listingVisibility")
|
|
1548
|
+
def listing_visibility(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1549
|
+
"""
|
|
1550
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1551
|
+
"""
|
|
1552
|
+
return pulumi.get(self, "listing_visibility")
|
|
1553
|
+
|
|
1042
1554
|
@_builtins.property
|
|
1043
1555
|
@pulumi.getter
|
|
1044
1556
|
def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1045
1557
|
"""
|
|
1046
|
-
|
|
1558
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1047
1559
|
"""
|
|
1048
1560
|
return pulumi.get(self, "local")
|
|
1049
1561
|
|
|
@@ -1051,8 +1563,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1051
1563
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
1052
1564
|
def max_lease_ttl_seconds(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1053
1565
|
"""
|
|
1054
|
-
|
|
1055
|
-
for credentials issued by this backend. Defaults to '0'.
|
|
1566
|
+
Maximum possible lease duration for secrets in seconds
|
|
1056
1567
|
"""
|
|
1057
1568
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
1058
1569
|
|
|
@@ -1067,6 +1578,22 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1067
1578
|
"""
|
|
1068
1579
|
return pulumi.get(self, "namespace")
|
|
1069
1580
|
|
|
1581
|
+
@_builtins.property
|
|
1582
|
+
@pulumi.getter
|
|
1583
|
+
def options(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1584
|
+
"""
|
|
1585
|
+
Specifies mount type specific options that are passed to the backend
|
|
1586
|
+
"""
|
|
1587
|
+
return pulumi.get(self, "options")
|
|
1588
|
+
|
|
1589
|
+
@_builtins.property
|
|
1590
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
1591
|
+
def passthrough_request_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1592
|
+
"""
|
|
1593
|
+
List of headers to allow and pass from the request to the plugin
|
|
1594
|
+
"""
|
|
1595
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
1596
|
+
|
|
1070
1597
|
@_builtins.property
|
|
1071
1598
|
@pulumi.getter
|
|
1072
1599
|
def path(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
@@ -1076,6 +1603,14 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1076
1603
|
"""
|
|
1077
1604
|
return pulumi.get(self, "path")
|
|
1078
1605
|
|
|
1606
|
+
@_builtins.property
|
|
1607
|
+
@pulumi.getter(name="pluginVersion")
|
|
1608
|
+
def plugin_version(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1609
|
+
"""
|
|
1610
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1611
|
+
"""
|
|
1612
|
+
return pulumi.get(self, "plugin_version")
|
|
1613
|
+
|
|
1079
1614
|
@_builtins.property
|
|
1080
1615
|
@pulumi.getter(name="rotationPeriod")
|
|
1081
1616
|
def rotation_period(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
@@ -1105,6 +1640,14 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1105
1640
|
"""
|
|
1106
1641
|
return pulumi.get(self, "rotation_window")
|
|
1107
1642
|
|
|
1643
|
+
@_builtins.property
|
|
1644
|
+
@pulumi.getter(name="sealWrap")
|
|
1645
|
+
def seal_wrap(self) -> pulumi.Output[_builtins.bool]:
|
|
1646
|
+
"""
|
|
1647
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1648
|
+
"""
|
|
1649
|
+
return pulumi.get(self, "seal_wrap")
|
|
1650
|
+
|
|
1108
1651
|
@_builtins.property
|
|
1109
1652
|
@pulumi.getter(name="serviceAccountEmail")
|
|
1110
1653
|
def service_account_email(self) -> pulumi.Output[Optional[_builtins.str]]:
|