pulumi-vault 7.2.0a1755297899__py3-none-any.whl → 7.2.1__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +18 -0
- pulumi_vault/_inputs.py +201 -0
- pulumi_vault/aws/secret_backend.py +627 -49
- pulumi_vault/azure/backend.py +788 -15
- pulumi_vault/consul/secret_backend.py +660 -28
- pulumi_vault/database/secrets_mount.py +47 -0
- pulumi_vault/gcp/secret_backend.py +599 -56
- pulumi_vault/jwt/auth_backend.py +47 -0
- pulumi_vault/kmip/secret_backend.py +787 -7
- pulumi_vault/kubernetes/secret_backend.py +47 -0
- pulumi_vault/ldap/secret_backend.py +75 -35
- pulumi_vault/mount.py +47 -0
- pulumi_vault/nomad_secret_backend.py +660 -21
- pulumi_vault/oci_auth_backend.py +683 -0
- pulumi_vault/oci_auth_backend_role.py +798 -0
- pulumi_vault/outputs.py +153 -0
- pulumi_vault/pkisecret/backend_config_scep.py +68 -21
- pulumi_vault/pkisecret/get_backend_config_scep.py +21 -1
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/rabbitmq/secret_backend.py +707 -35
- pulumi_vault/ssh/secret_backend_ca.py +101 -7
- pulumi_vault/terraformcloud/secret_backend.py +707 -28
- pulumi_vault/transit/secret_backend_key.py +49 -21
- {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.2.1.dist-info}/METADATA +1 -1
- {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.2.1.dist-info}/RECORD +27 -25
- {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.2.1.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.2.1.dist-info}/top_level.txt +0 -0
|
@@ -20,23 +20,35 @@ __all__ = ['SecretBackendArgs', 'SecretBackend']
|
|
|
20
20
|
class SecretBackendArgs:
|
|
21
21
|
def __init__(__self__, *,
|
|
22
22
|
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
23
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
24
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
25
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
26
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
23
27
|
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
28
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
24
29
|
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
25
30
|
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
26
31
|
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
32
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
33
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
27
34
|
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
28
35
|
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
29
36
|
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
37
|
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
38
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
39
|
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
32
40
|
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
33
41
|
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
42
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
43
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
34
44
|
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
45
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
46
|
region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
36
47
|
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
48
|
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
38
49
|
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
39
50
|
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
51
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
40
52
|
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
41
53
|
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
42
54
|
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
@@ -47,25 +59,34 @@ class SecretBackendArgs:
|
|
|
47
59
|
The set of arguments for constructing a SecretBackend resource.
|
|
48
60
|
:param pulumi.Input[_builtins.str] access_key: The AWS Access Key ID this backend should use to
|
|
49
61
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
50
|
-
:param pulumi.Input[_builtins.
|
|
51
|
-
|
|
52
|
-
:param pulumi.Input[_builtins.str]
|
|
62
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
63
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
64
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
65
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
66
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
67
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
68
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
53
69
|
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
54
70
|
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
55
71
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
72
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
73
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
56
74
|
:param pulumi.Input[_builtins.str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
57
75
|
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
|
|
58
|
-
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
76
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
59
77
|
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
60
|
-
:param pulumi.Input[_builtins.
|
|
61
|
-
:param pulumi.Input[_builtins.
|
|
62
|
-
|
|
78
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
79
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the secret backend is local only
|
|
80
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
63
81
|
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
64
82
|
The value should not contain leading or trailing forward slashes.
|
|
65
83
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
66
84
|
*Available only for Vault Enterprise*.
|
|
85
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
86
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
67
87
|
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
68
88
|
not begin or end with a `/`. Defaults to `aws`.
|
|
89
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
69
90
|
:param pulumi.Input[_builtins.str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
70
91
|
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
71
92
|
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
@@ -75,6 +96,7 @@ class SecretBackendArgs:
|
|
|
75
96
|
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
76
97
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
77
98
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
99
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
78
100
|
:param pulumi.Input[_builtins.str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
79
101
|
:param pulumi.Input[_builtins.str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
80
102
|
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
@@ -93,14 +115,28 @@ class SecretBackendArgs:
|
|
|
93
115
|
"""
|
|
94
116
|
if access_key is not None:
|
|
95
117
|
pulumi.set(__self__, "access_key", access_key)
|
|
118
|
+
if allowed_managed_keys is not None:
|
|
119
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
120
|
+
if allowed_response_headers is not None:
|
|
121
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
122
|
+
if audit_non_hmac_request_keys is not None:
|
|
123
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
124
|
+
if audit_non_hmac_response_keys is not None:
|
|
125
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
96
126
|
if default_lease_ttl_seconds is not None:
|
|
97
127
|
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
128
|
+
if delegated_auth_accessors is not None:
|
|
129
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
98
130
|
if description is not None:
|
|
99
131
|
pulumi.set(__self__, "description", description)
|
|
100
132
|
if disable_automated_rotation is not None:
|
|
101
133
|
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
102
134
|
if disable_remount is not None:
|
|
103
135
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
136
|
+
if external_entropy_access is not None:
|
|
137
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
138
|
+
if force_no_cache is not None:
|
|
139
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
104
140
|
if iam_endpoint is not None:
|
|
105
141
|
pulumi.set(__self__, "iam_endpoint", iam_endpoint)
|
|
106
142
|
if identity_token_audience is not None:
|
|
@@ -109,14 +145,22 @@ class SecretBackendArgs:
|
|
|
109
145
|
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
110
146
|
if identity_token_ttl is not None:
|
|
111
147
|
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
148
|
+
if listing_visibility is not None:
|
|
149
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
112
150
|
if local is not None:
|
|
113
151
|
pulumi.set(__self__, "local", local)
|
|
114
152
|
if max_lease_ttl_seconds is not None:
|
|
115
153
|
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
116
154
|
if namespace is not None:
|
|
117
155
|
pulumi.set(__self__, "namespace", namespace)
|
|
156
|
+
if options is not None:
|
|
157
|
+
pulumi.set(__self__, "options", options)
|
|
158
|
+
if passthrough_request_headers is not None:
|
|
159
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
118
160
|
if path is not None:
|
|
119
161
|
pulumi.set(__self__, "path", path)
|
|
162
|
+
if plugin_version is not None:
|
|
163
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
120
164
|
if region is not None:
|
|
121
165
|
pulumi.set(__self__, "region", region)
|
|
122
166
|
if role_arn is not None:
|
|
@@ -127,6 +171,8 @@ class SecretBackendArgs:
|
|
|
127
171
|
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
128
172
|
if rotation_window is not None:
|
|
129
173
|
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
174
|
+
if seal_wrap is not None:
|
|
175
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
130
176
|
if secret_key is not None:
|
|
131
177
|
pulumi.set(__self__, "secret_key", secret_key)
|
|
132
178
|
if sts_endpoint is not None:
|
|
@@ -153,12 +199,59 @@ class SecretBackendArgs:
|
|
|
153
199
|
def access_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
154
200
|
pulumi.set(self, "access_key", value)
|
|
155
201
|
|
|
202
|
+
@_builtins.property
|
|
203
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
204
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
205
|
+
"""
|
|
206
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
207
|
+
"""
|
|
208
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
209
|
+
|
|
210
|
+
@allowed_managed_keys.setter
|
|
211
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
212
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
213
|
+
|
|
214
|
+
@_builtins.property
|
|
215
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
216
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
217
|
+
"""
|
|
218
|
+
List of headers to allow and pass from the request to the plugin
|
|
219
|
+
"""
|
|
220
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
221
|
+
|
|
222
|
+
@allowed_response_headers.setter
|
|
223
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
224
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
225
|
+
|
|
226
|
+
@_builtins.property
|
|
227
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
228
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
229
|
+
"""
|
|
230
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
231
|
+
"""
|
|
232
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
233
|
+
|
|
234
|
+
@audit_non_hmac_request_keys.setter
|
|
235
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
236
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
237
|
+
|
|
238
|
+
@_builtins.property
|
|
239
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
240
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
241
|
+
"""
|
|
242
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
243
|
+
"""
|
|
244
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
245
|
+
|
|
246
|
+
@audit_non_hmac_response_keys.setter
|
|
247
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
248
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
249
|
+
|
|
156
250
|
@_builtins.property
|
|
157
251
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
158
252
|
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
159
253
|
"""
|
|
160
|
-
|
|
161
|
-
issued by this backend.
|
|
254
|
+
Default lease duration for secrets in seconds
|
|
162
255
|
"""
|
|
163
256
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
164
257
|
|
|
@@ -166,11 +259,23 @@ class SecretBackendArgs:
|
|
|
166
259
|
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
167
260
|
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
168
261
|
|
|
262
|
+
@_builtins.property
|
|
263
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
264
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
265
|
+
"""
|
|
266
|
+
List of headers to allow and pass from the request to the plugin
|
|
267
|
+
"""
|
|
268
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
269
|
+
|
|
270
|
+
@delegated_auth_accessors.setter
|
|
271
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
272
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
273
|
+
|
|
169
274
|
@_builtins.property
|
|
170
275
|
@pulumi.getter
|
|
171
276
|
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
172
277
|
"""
|
|
173
|
-
|
|
278
|
+
Human-friendly description of the mount for the backend.
|
|
174
279
|
"""
|
|
175
280
|
return pulumi.get(self, "description")
|
|
176
281
|
|
|
@@ -203,6 +308,30 @@ class SecretBackendArgs:
|
|
|
203
308
|
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
204
309
|
pulumi.set(self, "disable_remount", value)
|
|
205
310
|
|
|
311
|
+
@_builtins.property
|
|
312
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
313
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
314
|
+
"""
|
|
315
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
316
|
+
"""
|
|
317
|
+
return pulumi.get(self, "external_entropy_access")
|
|
318
|
+
|
|
319
|
+
@external_entropy_access.setter
|
|
320
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
321
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
322
|
+
|
|
323
|
+
@_builtins.property
|
|
324
|
+
@pulumi.getter(name="forceNoCache")
|
|
325
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
326
|
+
"""
|
|
327
|
+
If set to true, disables caching.
|
|
328
|
+
"""
|
|
329
|
+
return pulumi.get(self, "force_no_cache")
|
|
330
|
+
|
|
331
|
+
@force_no_cache.setter
|
|
332
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
333
|
+
pulumi.set(self, "force_no_cache", value)
|
|
334
|
+
|
|
206
335
|
@_builtins.property
|
|
207
336
|
@pulumi.getter(name="iamEndpoint")
|
|
208
337
|
def iam_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -231,7 +360,7 @@ class SecretBackendArgs:
|
|
|
231
360
|
@pulumi.getter(name="identityTokenKey")
|
|
232
361
|
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
233
362
|
"""
|
|
234
|
-
The key to use for signing identity tokens.
|
|
363
|
+
The key to use for signing identity tokens.
|
|
235
364
|
"""
|
|
236
365
|
return pulumi.get(self, "identity_token_key")
|
|
237
366
|
|
|
@@ -251,11 +380,23 @@ class SecretBackendArgs:
|
|
|
251
380
|
def identity_token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
252
381
|
pulumi.set(self, "identity_token_ttl", value)
|
|
253
382
|
|
|
383
|
+
@_builtins.property
|
|
384
|
+
@pulumi.getter(name="listingVisibility")
|
|
385
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
386
|
+
"""
|
|
387
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
388
|
+
"""
|
|
389
|
+
return pulumi.get(self, "listing_visibility")
|
|
390
|
+
|
|
391
|
+
@listing_visibility.setter
|
|
392
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
393
|
+
pulumi.set(self, "listing_visibility", value)
|
|
394
|
+
|
|
254
395
|
@_builtins.property
|
|
255
396
|
@pulumi.getter
|
|
256
397
|
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
257
398
|
"""
|
|
258
|
-
Specifies
|
|
399
|
+
Specifies if the secret backend is local only
|
|
259
400
|
"""
|
|
260
401
|
return pulumi.get(self, "local")
|
|
261
402
|
|
|
@@ -267,8 +408,7 @@ class SecretBackendArgs:
|
|
|
267
408
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
268
409
|
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
269
410
|
"""
|
|
270
|
-
|
|
271
|
-
for credentials issued by this backend.
|
|
411
|
+
Maximum possible lease duration for secrets in seconds
|
|
272
412
|
"""
|
|
273
413
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
274
414
|
|
|
@@ -291,6 +431,30 @@ class SecretBackendArgs:
|
|
|
291
431
|
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
292
432
|
pulumi.set(self, "namespace", value)
|
|
293
433
|
|
|
434
|
+
@_builtins.property
|
|
435
|
+
@pulumi.getter
|
|
436
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
437
|
+
"""
|
|
438
|
+
Specifies mount type specific options that are passed to the backend
|
|
439
|
+
"""
|
|
440
|
+
return pulumi.get(self, "options")
|
|
441
|
+
|
|
442
|
+
@options.setter
|
|
443
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
444
|
+
pulumi.set(self, "options", value)
|
|
445
|
+
|
|
446
|
+
@_builtins.property
|
|
447
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
448
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
449
|
+
"""
|
|
450
|
+
List of headers to allow and pass from the request to the plugin
|
|
451
|
+
"""
|
|
452
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
453
|
+
|
|
454
|
+
@passthrough_request_headers.setter
|
|
455
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
456
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
457
|
+
|
|
294
458
|
@_builtins.property
|
|
295
459
|
@pulumi.getter
|
|
296
460
|
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -304,6 +468,18 @@ class SecretBackendArgs:
|
|
|
304
468
|
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
305
469
|
pulumi.set(self, "path", value)
|
|
306
470
|
|
|
471
|
+
@_builtins.property
|
|
472
|
+
@pulumi.getter(name="pluginVersion")
|
|
473
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
474
|
+
"""
|
|
475
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
476
|
+
"""
|
|
477
|
+
return pulumi.get(self, "plugin_version")
|
|
478
|
+
|
|
479
|
+
@plugin_version.setter
|
|
480
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
481
|
+
pulumi.set(self, "plugin_version", value)
|
|
482
|
+
|
|
307
483
|
@_builtins.property
|
|
308
484
|
@pulumi.getter
|
|
309
485
|
def region(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -368,6 +544,18 @@ class SecretBackendArgs:
|
|
|
368
544
|
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
369
545
|
pulumi.set(self, "rotation_window", value)
|
|
370
546
|
|
|
547
|
+
@_builtins.property
|
|
548
|
+
@pulumi.getter(name="sealWrap")
|
|
549
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
550
|
+
"""
|
|
551
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
552
|
+
"""
|
|
553
|
+
return pulumi.get(self, "seal_wrap")
|
|
554
|
+
|
|
555
|
+
@seal_wrap.setter
|
|
556
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
557
|
+
pulumi.set(self, "seal_wrap", value)
|
|
558
|
+
|
|
371
559
|
@_builtins.property
|
|
372
560
|
@pulumi.getter(name="secretKey")
|
|
373
561
|
def secret_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -454,23 +642,36 @@ class SecretBackendArgs:
|
|
|
454
642
|
class _SecretBackendState:
|
|
455
643
|
def __init__(__self__, *,
|
|
456
644
|
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
645
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
646
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
647
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
648
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
649
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
457
650
|
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
651
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
458
652
|
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
459
653
|
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
460
654
|
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
655
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
656
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
461
657
|
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
462
658
|
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
463
659
|
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
464
660
|
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
661
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
465
662
|
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
466
663
|
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
467
664
|
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
665
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
666
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
468
667
|
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
668
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
469
669
|
region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
470
670
|
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
471
671
|
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
472
672
|
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
473
673
|
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
674
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
474
675
|
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
475
676
|
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
476
677
|
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
@@ -481,25 +682,35 @@ class _SecretBackendState:
|
|
|
481
682
|
Input properties used for looking up and filtering SecretBackend resources.
|
|
482
683
|
:param pulumi.Input[_builtins.str] access_key: The AWS Access Key ID this backend should use to
|
|
483
684
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
484
|
-
:param pulumi.Input[_builtins.
|
|
485
|
-
|
|
486
|
-
:param pulumi.Input[_builtins.str]
|
|
685
|
+
:param pulumi.Input[_builtins.str] accessor: Accessor of the mount
|
|
686
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
687
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
688
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
689
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
690
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
691
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
692
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
487
693
|
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
488
694
|
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
489
695
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
696
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
697
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
490
698
|
:param pulumi.Input[_builtins.str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
491
699
|
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
|
|
492
|
-
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
700
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
493
701
|
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
494
|
-
:param pulumi.Input[_builtins.
|
|
495
|
-
:param pulumi.Input[_builtins.
|
|
496
|
-
|
|
702
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
703
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the secret backend is local only
|
|
704
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
497
705
|
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
498
706
|
The value should not contain leading or trailing forward slashes.
|
|
499
707
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
500
708
|
*Available only for Vault Enterprise*.
|
|
709
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
710
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
501
711
|
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
502
712
|
not begin or end with a `/`. Defaults to `aws`.
|
|
713
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
503
714
|
:param pulumi.Input[_builtins.str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
504
715
|
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
505
716
|
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
@@ -509,6 +720,7 @@ class _SecretBackendState:
|
|
|
509
720
|
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
510
721
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
511
722
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
723
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
512
724
|
:param pulumi.Input[_builtins.str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
513
725
|
:param pulumi.Input[_builtins.str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
514
726
|
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
@@ -527,14 +739,30 @@ class _SecretBackendState:
|
|
|
527
739
|
"""
|
|
528
740
|
if access_key is not None:
|
|
529
741
|
pulumi.set(__self__, "access_key", access_key)
|
|
742
|
+
if accessor is not None:
|
|
743
|
+
pulumi.set(__self__, "accessor", accessor)
|
|
744
|
+
if allowed_managed_keys is not None:
|
|
745
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
746
|
+
if allowed_response_headers is not None:
|
|
747
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
748
|
+
if audit_non_hmac_request_keys is not None:
|
|
749
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
750
|
+
if audit_non_hmac_response_keys is not None:
|
|
751
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
530
752
|
if default_lease_ttl_seconds is not None:
|
|
531
753
|
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
754
|
+
if delegated_auth_accessors is not None:
|
|
755
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
532
756
|
if description is not None:
|
|
533
757
|
pulumi.set(__self__, "description", description)
|
|
534
758
|
if disable_automated_rotation is not None:
|
|
535
759
|
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
536
760
|
if disable_remount is not None:
|
|
537
761
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
762
|
+
if external_entropy_access is not None:
|
|
763
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
764
|
+
if force_no_cache is not None:
|
|
765
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
538
766
|
if iam_endpoint is not None:
|
|
539
767
|
pulumi.set(__self__, "iam_endpoint", iam_endpoint)
|
|
540
768
|
if identity_token_audience is not None:
|
|
@@ -543,14 +771,22 @@ class _SecretBackendState:
|
|
|
543
771
|
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
544
772
|
if identity_token_ttl is not None:
|
|
545
773
|
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
774
|
+
if listing_visibility is not None:
|
|
775
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
546
776
|
if local is not None:
|
|
547
777
|
pulumi.set(__self__, "local", local)
|
|
548
778
|
if max_lease_ttl_seconds is not None:
|
|
549
779
|
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
550
780
|
if namespace is not None:
|
|
551
781
|
pulumi.set(__self__, "namespace", namespace)
|
|
782
|
+
if options is not None:
|
|
783
|
+
pulumi.set(__self__, "options", options)
|
|
784
|
+
if passthrough_request_headers is not None:
|
|
785
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
552
786
|
if path is not None:
|
|
553
787
|
pulumi.set(__self__, "path", path)
|
|
788
|
+
if plugin_version is not None:
|
|
789
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
554
790
|
if region is not None:
|
|
555
791
|
pulumi.set(__self__, "region", region)
|
|
556
792
|
if role_arn is not None:
|
|
@@ -561,6 +797,8 @@ class _SecretBackendState:
|
|
|
561
797
|
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
562
798
|
if rotation_window is not None:
|
|
563
799
|
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
800
|
+
if seal_wrap is not None:
|
|
801
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
564
802
|
if secret_key is not None:
|
|
565
803
|
pulumi.set(__self__, "secret_key", secret_key)
|
|
566
804
|
if sts_endpoint is not None:
|
|
@@ -587,12 +825,71 @@ class _SecretBackendState:
|
|
|
587
825
|
def access_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
588
826
|
pulumi.set(self, "access_key", value)
|
|
589
827
|
|
|
828
|
+
@_builtins.property
|
|
829
|
+
@pulumi.getter
|
|
830
|
+
def accessor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
831
|
+
"""
|
|
832
|
+
Accessor of the mount
|
|
833
|
+
"""
|
|
834
|
+
return pulumi.get(self, "accessor")
|
|
835
|
+
|
|
836
|
+
@accessor.setter
|
|
837
|
+
def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
838
|
+
pulumi.set(self, "accessor", value)
|
|
839
|
+
|
|
840
|
+
@_builtins.property
|
|
841
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
842
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
843
|
+
"""
|
|
844
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
845
|
+
"""
|
|
846
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
847
|
+
|
|
848
|
+
@allowed_managed_keys.setter
|
|
849
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
850
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
851
|
+
|
|
852
|
+
@_builtins.property
|
|
853
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
854
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
855
|
+
"""
|
|
856
|
+
List of headers to allow and pass from the request to the plugin
|
|
857
|
+
"""
|
|
858
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
859
|
+
|
|
860
|
+
@allowed_response_headers.setter
|
|
861
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
862
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
863
|
+
|
|
864
|
+
@_builtins.property
|
|
865
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
866
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
867
|
+
"""
|
|
868
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
869
|
+
"""
|
|
870
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
871
|
+
|
|
872
|
+
@audit_non_hmac_request_keys.setter
|
|
873
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
874
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
875
|
+
|
|
876
|
+
@_builtins.property
|
|
877
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
878
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
879
|
+
"""
|
|
880
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
881
|
+
"""
|
|
882
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
883
|
+
|
|
884
|
+
@audit_non_hmac_response_keys.setter
|
|
885
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
886
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
887
|
+
|
|
590
888
|
@_builtins.property
|
|
591
889
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
592
890
|
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
593
891
|
"""
|
|
594
|
-
|
|
595
|
-
issued by this backend.
|
|
892
|
+
Default lease duration for secrets in seconds
|
|
596
893
|
"""
|
|
597
894
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
598
895
|
|
|
@@ -600,11 +897,23 @@ class _SecretBackendState:
|
|
|
600
897
|
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
601
898
|
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
602
899
|
|
|
900
|
+
@_builtins.property
|
|
901
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
902
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
903
|
+
"""
|
|
904
|
+
List of headers to allow and pass from the request to the plugin
|
|
905
|
+
"""
|
|
906
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
907
|
+
|
|
908
|
+
@delegated_auth_accessors.setter
|
|
909
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
910
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
911
|
+
|
|
603
912
|
@_builtins.property
|
|
604
913
|
@pulumi.getter
|
|
605
914
|
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
606
915
|
"""
|
|
607
|
-
|
|
916
|
+
Human-friendly description of the mount for the backend.
|
|
608
917
|
"""
|
|
609
918
|
return pulumi.get(self, "description")
|
|
610
919
|
|
|
@@ -637,6 +946,30 @@ class _SecretBackendState:
|
|
|
637
946
|
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
638
947
|
pulumi.set(self, "disable_remount", value)
|
|
639
948
|
|
|
949
|
+
@_builtins.property
|
|
950
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
951
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
952
|
+
"""
|
|
953
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
954
|
+
"""
|
|
955
|
+
return pulumi.get(self, "external_entropy_access")
|
|
956
|
+
|
|
957
|
+
@external_entropy_access.setter
|
|
958
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
959
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
960
|
+
|
|
961
|
+
@_builtins.property
|
|
962
|
+
@pulumi.getter(name="forceNoCache")
|
|
963
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
964
|
+
"""
|
|
965
|
+
If set to true, disables caching.
|
|
966
|
+
"""
|
|
967
|
+
return pulumi.get(self, "force_no_cache")
|
|
968
|
+
|
|
969
|
+
@force_no_cache.setter
|
|
970
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
971
|
+
pulumi.set(self, "force_no_cache", value)
|
|
972
|
+
|
|
640
973
|
@_builtins.property
|
|
641
974
|
@pulumi.getter(name="iamEndpoint")
|
|
642
975
|
def iam_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -665,7 +998,7 @@ class _SecretBackendState:
|
|
|
665
998
|
@pulumi.getter(name="identityTokenKey")
|
|
666
999
|
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
667
1000
|
"""
|
|
668
|
-
The key to use for signing identity tokens.
|
|
1001
|
+
The key to use for signing identity tokens.
|
|
669
1002
|
"""
|
|
670
1003
|
return pulumi.get(self, "identity_token_key")
|
|
671
1004
|
|
|
@@ -685,11 +1018,23 @@ class _SecretBackendState:
|
|
|
685
1018
|
def identity_token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
686
1019
|
pulumi.set(self, "identity_token_ttl", value)
|
|
687
1020
|
|
|
1021
|
+
@_builtins.property
|
|
1022
|
+
@pulumi.getter(name="listingVisibility")
|
|
1023
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1024
|
+
"""
|
|
1025
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1026
|
+
"""
|
|
1027
|
+
return pulumi.get(self, "listing_visibility")
|
|
1028
|
+
|
|
1029
|
+
@listing_visibility.setter
|
|
1030
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1031
|
+
pulumi.set(self, "listing_visibility", value)
|
|
1032
|
+
|
|
688
1033
|
@_builtins.property
|
|
689
1034
|
@pulumi.getter
|
|
690
1035
|
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
691
1036
|
"""
|
|
692
|
-
Specifies
|
|
1037
|
+
Specifies if the secret backend is local only
|
|
693
1038
|
"""
|
|
694
1039
|
return pulumi.get(self, "local")
|
|
695
1040
|
|
|
@@ -701,8 +1046,7 @@ class _SecretBackendState:
|
|
|
701
1046
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
702
1047
|
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
703
1048
|
"""
|
|
704
|
-
|
|
705
|
-
for credentials issued by this backend.
|
|
1049
|
+
Maximum possible lease duration for secrets in seconds
|
|
706
1050
|
"""
|
|
707
1051
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
708
1052
|
|
|
@@ -725,6 +1069,30 @@ class _SecretBackendState:
|
|
|
725
1069
|
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
726
1070
|
pulumi.set(self, "namespace", value)
|
|
727
1071
|
|
|
1072
|
+
@_builtins.property
|
|
1073
|
+
@pulumi.getter
|
|
1074
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
1075
|
+
"""
|
|
1076
|
+
Specifies mount type specific options that are passed to the backend
|
|
1077
|
+
"""
|
|
1078
|
+
return pulumi.get(self, "options")
|
|
1079
|
+
|
|
1080
|
+
@options.setter
|
|
1081
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
1082
|
+
pulumi.set(self, "options", value)
|
|
1083
|
+
|
|
1084
|
+
@_builtins.property
|
|
1085
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
1086
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
1087
|
+
"""
|
|
1088
|
+
List of headers to allow and pass from the request to the plugin
|
|
1089
|
+
"""
|
|
1090
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
1091
|
+
|
|
1092
|
+
@passthrough_request_headers.setter
|
|
1093
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
1094
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
1095
|
+
|
|
728
1096
|
@_builtins.property
|
|
729
1097
|
@pulumi.getter
|
|
730
1098
|
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -738,6 +1106,18 @@ class _SecretBackendState:
|
|
|
738
1106
|
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
739
1107
|
pulumi.set(self, "path", value)
|
|
740
1108
|
|
|
1109
|
+
@_builtins.property
|
|
1110
|
+
@pulumi.getter(name="pluginVersion")
|
|
1111
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1112
|
+
"""
|
|
1113
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1114
|
+
"""
|
|
1115
|
+
return pulumi.get(self, "plugin_version")
|
|
1116
|
+
|
|
1117
|
+
@plugin_version.setter
|
|
1118
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1119
|
+
pulumi.set(self, "plugin_version", value)
|
|
1120
|
+
|
|
741
1121
|
@_builtins.property
|
|
742
1122
|
@pulumi.getter
|
|
743
1123
|
def region(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -802,6 +1182,18 @@ class _SecretBackendState:
|
|
|
802
1182
|
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
803
1183
|
pulumi.set(self, "rotation_window", value)
|
|
804
1184
|
|
|
1185
|
+
@_builtins.property
|
|
1186
|
+
@pulumi.getter(name="sealWrap")
|
|
1187
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1188
|
+
"""
|
|
1189
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1190
|
+
"""
|
|
1191
|
+
return pulumi.get(self, "seal_wrap")
|
|
1192
|
+
|
|
1193
|
+
@seal_wrap.setter
|
|
1194
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1195
|
+
pulumi.set(self, "seal_wrap", value)
|
|
1196
|
+
|
|
805
1197
|
@_builtins.property
|
|
806
1198
|
@pulumi.getter(name="secretKey")
|
|
807
1199
|
def secret_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
@@ -891,23 +1283,35 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
891
1283
|
resource_name: str,
|
|
892
1284
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
893
1285
|
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1286
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1287
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1288
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1289
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
894
1290
|
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1291
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
895
1292
|
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
896
1293
|
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
897
1294
|
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1295
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1296
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
898
1297
|
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
899
1298
|
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
900
1299
|
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
901
1300
|
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1301
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
902
1302
|
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
903
1303
|
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
904
1304
|
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1305
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1306
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
905
1307
|
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1308
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
906
1309
|
region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
907
1310
|
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
908
1311
|
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
909
1312
|
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
910
1313
|
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1314
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
911
1315
|
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
912
1316
|
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
913
1317
|
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
@@ -928,25 +1332,34 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
928
1332
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
929
1333
|
:param pulumi.Input[_builtins.str] access_key: The AWS Access Key ID this backend should use to
|
|
930
1334
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
931
|
-
:param pulumi.Input[_builtins.
|
|
932
|
-
|
|
933
|
-
:param pulumi.Input[_builtins.str]
|
|
1335
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1336
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1337
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1338
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1339
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
1340
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1341
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
934
1342
|
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
935
1343
|
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
936
1344
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1345
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1346
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
937
1347
|
:param pulumi.Input[_builtins.str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
938
1348
|
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
|
|
939
|
-
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
1349
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
940
1350
|
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
941
|
-
:param pulumi.Input[_builtins.
|
|
942
|
-
:param pulumi.Input[_builtins.
|
|
943
|
-
|
|
1351
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1352
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the secret backend is local only
|
|
1353
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
944
1354
|
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
945
1355
|
The value should not contain leading or trailing forward slashes.
|
|
946
1356
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
947
1357
|
*Available only for Vault Enterprise*.
|
|
1358
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1359
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
948
1360
|
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
949
1361
|
not begin or end with a `/`. Defaults to `aws`.
|
|
1362
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
950
1363
|
:param pulumi.Input[_builtins.str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
951
1364
|
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
952
1365
|
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
@@ -956,6 +1369,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
956
1369
|
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
957
1370
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
958
1371
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
1372
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
959
1373
|
:param pulumi.Input[_builtins.str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
960
1374
|
:param pulumi.Input[_builtins.str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
961
1375
|
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
@@ -1003,23 +1417,35 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1003
1417
|
resource_name: str,
|
|
1004
1418
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1005
1419
|
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1420
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1421
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1422
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1423
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1006
1424
|
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1425
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1007
1426
|
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1008
1427
|
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1009
1428
|
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1429
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1430
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1010
1431
|
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1011
1432
|
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1012
1433
|
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1013
1434
|
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1435
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1014
1436
|
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1015
1437
|
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1016
1438
|
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1439
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1440
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1017
1441
|
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1442
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1018
1443
|
region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1019
1444
|
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1020
1445
|
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1021
1446
|
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1022
1447
|
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1448
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1023
1449
|
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1024
1450
|
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1025
1451
|
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
@@ -1036,29 +1462,42 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1036
1462
|
__props__ = SecretBackendArgs.__new__(SecretBackendArgs)
|
|
1037
1463
|
|
|
1038
1464
|
__props__.__dict__["access_key"] = None if access_key is None else pulumi.Output.secret(access_key)
|
|
1465
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1466
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1467
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1468
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
1039
1469
|
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
1470
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
1040
1471
|
__props__.__dict__["description"] = description
|
|
1041
1472
|
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
1042
1473
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1474
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1475
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
1043
1476
|
__props__.__dict__["iam_endpoint"] = iam_endpoint
|
|
1044
1477
|
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
1045
1478
|
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
1046
1479
|
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
1480
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
1047
1481
|
__props__.__dict__["local"] = local
|
|
1048
1482
|
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
1049
1483
|
__props__.__dict__["namespace"] = namespace
|
|
1484
|
+
__props__.__dict__["options"] = options
|
|
1485
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
1050
1486
|
__props__.__dict__["path"] = path
|
|
1487
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
1051
1488
|
__props__.__dict__["region"] = region
|
|
1052
1489
|
__props__.__dict__["role_arn"] = role_arn
|
|
1053
1490
|
__props__.__dict__["rotation_period"] = rotation_period
|
|
1054
1491
|
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
1055
1492
|
__props__.__dict__["rotation_window"] = rotation_window
|
|
1493
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
1056
1494
|
__props__.__dict__["secret_key"] = None if secret_key is None else pulumi.Output.secret(secret_key)
|
|
1057
1495
|
__props__.__dict__["sts_endpoint"] = sts_endpoint
|
|
1058
1496
|
__props__.__dict__["sts_fallback_endpoints"] = sts_fallback_endpoints
|
|
1059
1497
|
__props__.__dict__["sts_fallback_regions"] = sts_fallback_regions
|
|
1060
1498
|
__props__.__dict__["sts_region"] = sts_region
|
|
1061
1499
|
__props__.__dict__["username_template"] = username_template
|
|
1500
|
+
__props__.__dict__["accessor"] = None
|
|
1062
1501
|
secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["accessKey", "secretKey"])
|
|
1063
1502
|
opts = pulumi.ResourceOptions.merge(opts, secret_opts)
|
|
1064
1503
|
super(SecretBackend, __self__).__init__(
|
|
@@ -1072,23 +1511,36 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1072
1511
|
id: pulumi.Input[str],
|
|
1073
1512
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1074
1513
|
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1514
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1515
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1516
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1517
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1518
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1075
1519
|
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1520
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1076
1521
|
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1077
1522
|
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1078
1523
|
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1524
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1525
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1079
1526
|
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1080
1527
|
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1081
1528
|
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1082
1529
|
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1530
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1083
1531
|
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1084
1532
|
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1085
1533
|
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1534
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1535
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1086
1536
|
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1537
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1087
1538
|
region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1088
1539
|
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1089
1540
|
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1090
1541
|
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1091
1542
|
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1543
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1092
1544
|
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1093
1545
|
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1094
1546
|
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
@@ -1104,25 +1556,35 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1104
1556
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1105
1557
|
:param pulumi.Input[_builtins.str] access_key: The AWS Access Key ID this backend should use to
|
|
1106
1558
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
1107
|
-
:param pulumi.Input[_builtins.
|
|
1108
|
-
|
|
1109
|
-
:param pulumi.Input[_builtins.str]
|
|
1559
|
+
:param pulumi.Input[_builtins.str] accessor: Accessor of the mount
|
|
1560
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1561
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1562
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1563
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1564
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
1565
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1566
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
1110
1567
|
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1111
1568
|
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
1112
1569
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1570
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1571
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
1113
1572
|
:param pulumi.Input[_builtins.str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
1114
1573
|
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
|
|
1115
|
-
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
1574
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
1116
1575
|
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
1117
|
-
:param pulumi.Input[_builtins.
|
|
1118
|
-
:param pulumi.Input[_builtins.
|
|
1119
|
-
|
|
1576
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1577
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the secret backend is local only
|
|
1578
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
1120
1579
|
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
1121
1580
|
The value should not contain leading or trailing forward slashes.
|
|
1122
1581
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1123
1582
|
*Available only for Vault Enterprise*.
|
|
1583
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1584
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
1124
1585
|
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
1125
1586
|
not begin or end with a `/`. Defaults to `aws`.
|
|
1587
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1126
1588
|
:param pulumi.Input[_builtins.str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
1127
1589
|
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
1128
1590
|
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
@@ -1132,6 +1594,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1132
1594
|
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
1133
1595
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
1134
1596
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
1597
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1135
1598
|
:param pulumi.Input[_builtins.str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
1136
1599
|
:param pulumi.Input[_builtins.str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
1137
1600
|
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
@@ -1153,23 +1616,36 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1153
1616
|
__props__ = _SecretBackendState.__new__(_SecretBackendState)
|
|
1154
1617
|
|
|
1155
1618
|
__props__.__dict__["access_key"] = access_key
|
|
1619
|
+
__props__.__dict__["accessor"] = accessor
|
|
1620
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1621
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1622
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1623
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
1156
1624
|
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
1625
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
1157
1626
|
__props__.__dict__["description"] = description
|
|
1158
1627
|
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
1159
1628
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1629
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1630
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
1160
1631
|
__props__.__dict__["iam_endpoint"] = iam_endpoint
|
|
1161
1632
|
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
1162
1633
|
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
1163
1634
|
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
1635
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
1164
1636
|
__props__.__dict__["local"] = local
|
|
1165
1637
|
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
1166
1638
|
__props__.__dict__["namespace"] = namespace
|
|
1639
|
+
__props__.__dict__["options"] = options
|
|
1640
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
1167
1641
|
__props__.__dict__["path"] = path
|
|
1642
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
1168
1643
|
__props__.__dict__["region"] = region
|
|
1169
1644
|
__props__.__dict__["role_arn"] = role_arn
|
|
1170
1645
|
__props__.__dict__["rotation_period"] = rotation_period
|
|
1171
1646
|
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
1172
1647
|
__props__.__dict__["rotation_window"] = rotation_window
|
|
1648
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
1173
1649
|
__props__.__dict__["secret_key"] = secret_key
|
|
1174
1650
|
__props__.__dict__["sts_endpoint"] = sts_endpoint
|
|
1175
1651
|
__props__.__dict__["sts_fallback_endpoints"] = sts_fallback_endpoints
|
|
@@ -1187,20 +1663,67 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1187
1663
|
"""
|
|
1188
1664
|
return pulumi.get(self, "access_key")
|
|
1189
1665
|
|
|
1666
|
+
@_builtins.property
|
|
1667
|
+
@pulumi.getter
|
|
1668
|
+
def accessor(self) -> pulumi.Output[_builtins.str]:
|
|
1669
|
+
"""
|
|
1670
|
+
Accessor of the mount
|
|
1671
|
+
"""
|
|
1672
|
+
return pulumi.get(self, "accessor")
|
|
1673
|
+
|
|
1674
|
+
@_builtins.property
|
|
1675
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
1676
|
+
def allowed_managed_keys(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1677
|
+
"""
|
|
1678
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
1679
|
+
"""
|
|
1680
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
1681
|
+
|
|
1682
|
+
@_builtins.property
|
|
1683
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
1684
|
+
def allowed_response_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1685
|
+
"""
|
|
1686
|
+
List of headers to allow and pass from the request to the plugin
|
|
1687
|
+
"""
|
|
1688
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
1689
|
+
|
|
1690
|
+
@_builtins.property
|
|
1691
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
1692
|
+
def audit_non_hmac_request_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1693
|
+
"""
|
|
1694
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1695
|
+
"""
|
|
1696
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
1697
|
+
|
|
1698
|
+
@_builtins.property
|
|
1699
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
1700
|
+
def audit_non_hmac_response_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1701
|
+
"""
|
|
1702
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1703
|
+
"""
|
|
1704
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
1705
|
+
|
|
1190
1706
|
@_builtins.property
|
|
1191
1707
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
1192
1708
|
def default_lease_ttl_seconds(self) -> pulumi.Output[_builtins.int]:
|
|
1193
1709
|
"""
|
|
1194
|
-
|
|
1195
|
-
issued by this backend.
|
|
1710
|
+
Default lease duration for secrets in seconds
|
|
1196
1711
|
"""
|
|
1197
1712
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
1198
1713
|
|
|
1714
|
+
@_builtins.property
|
|
1715
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
1716
|
+
def delegated_auth_accessors(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1717
|
+
"""
|
|
1718
|
+
List of headers to allow and pass from the request to the plugin
|
|
1719
|
+
"""
|
|
1720
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
1721
|
+
|
|
1199
1722
|
@_builtins.property
|
|
1200
1723
|
@pulumi.getter
|
|
1201
1724
|
def description(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1202
1725
|
"""
|
|
1203
|
-
|
|
1726
|
+
Human-friendly description of the mount for the backend.
|
|
1204
1727
|
"""
|
|
1205
1728
|
return pulumi.get(self, "description")
|
|
1206
1729
|
|
|
@@ -1221,6 +1744,22 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1221
1744
|
"""
|
|
1222
1745
|
return pulumi.get(self, "disable_remount")
|
|
1223
1746
|
|
|
1747
|
+
@_builtins.property
|
|
1748
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
1749
|
+
def external_entropy_access(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1750
|
+
"""
|
|
1751
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
1752
|
+
"""
|
|
1753
|
+
return pulumi.get(self, "external_entropy_access")
|
|
1754
|
+
|
|
1755
|
+
@_builtins.property
|
|
1756
|
+
@pulumi.getter(name="forceNoCache")
|
|
1757
|
+
def force_no_cache(self) -> pulumi.Output[_builtins.bool]:
|
|
1758
|
+
"""
|
|
1759
|
+
If set to true, disables caching.
|
|
1760
|
+
"""
|
|
1761
|
+
return pulumi.get(self, "force_no_cache")
|
|
1762
|
+
|
|
1224
1763
|
@_builtins.property
|
|
1225
1764
|
@pulumi.getter(name="iamEndpoint")
|
|
1226
1765
|
def iam_endpoint(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
@@ -1241,7 +1780,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1241
1780
|
@pulumi.getter(name="identityTokenKey")
|
|
1242
1781
|
def identity_token_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1243
1782
|
"""
|
|
1244
|
-
The key to use for signing identity tokens.
|
|
1783
|
+
The key to use for signing identity tokens.
|
|
1245
1784
|
"""
|
|
1246
1785
|
return pulumi.get(self, "identity_token_key")
|
|
1247
1786
|
|
|
@@ -1253,11 +1792,19 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1253
1792
|
"""
|
|
1254
1793
|
return pulumi.get(self, "identity_token_ttl")
|
|
1255
1794
|
|
|
1795
|
+
@_builtins.property
|
|
1796
|
+
@pulumi.getter(name="listingVisibility")
|
|
1797
|
+
def listing_visibility(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1798
|
+
"""
|
|
1799
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1800
|
+
"""
|
|
1801
|
+
return pulumi.get(self, "listing_visibility")
|
|
1802
|
+
|
|
1256
1803
|
@_builtins.property
|
|
1257
1804
|
@pulumi.getter
|
|
1258
1805
|
def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1259
1806
|
"""
|
|
1260
|
-
Specifies
|
|
1807
|
+
Specifies if the secret backend is local only
|
|
1261
1808
|
"""
|
|
1262
1809
|
return pulumi.get(self, "local")
|
|
1263
1810
|
|
|
@@ -1265,8 +1812,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1265
1812
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
1266
1813
|
def max_lease_ttl_seconds(self) -> pulumi.Output[_builtins.int]:
|
|
1267
1814
|
"""
|
|
1268
|
-
|
|
1269
|
-
for credentials issued by this backend.
|
|
1815
|
+
Maximum possible lease duration for secrets in seconds
|
|
1270
1816
|
"""
|
|
1271
1817
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
1272
1818
|
|
|
@@ -1281,6 +1827,22 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1281
1827
|
"""
|
|
1282
1828
|
return pulumi.get(self, "namespace")
|
|
1283
1829
|
|
|
1830
|
+
@_builtins.property
|
|
1831
|
+
@pulumi.getter
|
|
1832
|
+
def options(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1833
|
+
"""
|
|
1834
|
+
Specifies mount type specific options that are passed to the backend
|
|
1835
|
+
"""
|
|
1836
|
+
return pulumi.get(self, "options")
|
|
1837
|
+
|
|
1838
|
+
@_builtins.property
|
|
1839
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
1840
|
+
def passthrough_request_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1841
|
+
"""
|
|
1842
|
+
List of headers to allow and pass from the request to the plugin
|
|
1843
|
+
"""
|
|
1844
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
1845
|
+
|
|
1284
1846
|
@_builtins.property
|
|
1285
1847
|
@pulumi.getter
|
|
1286
1848
|
def path(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
@@ -1290,6 +1852,14 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1290
1852
|
"""
|
|
1291
1853
|
return pulumi.get(self, "path")
|
|
1292
1854
|
|
|
1855
|
+
@_builtins.property
|
|
1856
|
+
@pulumi.getter(name="pluginVersion")
|
|
1857
|
+
def plugin_version(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1858
|
+
"""
|
|
1859
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1860
|
+
"""
|
|
1861
|
+
return pulumi.get(self, "plugin_version")
|
|
1862
|
+
|
|
1293
1863
|
@_builtins.property
|
|
1294
1864
|
@pulumi.getter
|
|
1295
1865
|
def region(self) -> pulumi.Output[_builtins.str]:
|
|
@@ -1334,6 +1904,14 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1334
1904
|
"""
|
|
1335
1905
|
return pulumi.get(self, "rotation_window")
|
|
1336
1906
|
|
|
1907
|
+
@_builtins.property
|
|
1908
|
+
@pulumi.getter(name="sealWrap")
|
|
1909
|
+
def seal_wrap(self) -> pulumi.Output[_builtins.bool]:
|
|
1910
|
+
"""
|
|
1911
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1912
|
+
"""
|
|
1913
|
+
return pulumi.get(self, "seal_wrap")
|
|
1914
|
+
|
|
1337
1915
|
@_builtins.property
|
|
1338
1916
|
@pulumi.getter(name="secretKey")
|
|
1339
1917
|
def secret_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|