pulumi-vault 7.2.0a1755297899__py3-none-any.whl → 7.3.0a1755586140__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (27) hide show
  1. pulumi_vault/__init__.py +18 -0
  2. pulumi_vault/_inputs.py +201 -0
  3. pulumi_vault/aws/secret_backend.py +627 -49
  4. pulumi_vault/azure/backend.py +788 -15
  5. pulumi_vault/consul/secret_backend.py +660 -28
  6. pulumi_vault/database/secrets_mount.py +47 -0
  7. pulumi_vault/gcp/secret_backend.py +599 -56
  8. pulumi_vault/jwt/auth_backend.py +47 -0
  9. pulumi_vault/kmip/secret_backend.py +787 -7
  10. pulumi_vault/kubernetes/secret_backend.py +47 -0
  11. pulumi_vault/ldap/secret_backend.py +75 -35
  12. pulumi_vault/mount.py +47 -0
  13. pulumi_vault/nomad_secret_backend.py +660 -21
  14. pulumi_vault/oci_auth_backend.py +683 -0
  15. pulumi_vault/oci_auth_backend_role.py +798 -0
  16. pulumi_vault/outputs.py +153 -0
  17. pulumi_vault/pkisecret/backend_config_scep.py +68 -21
  18. pulumi_vault/pkisecret/get_backend_config_scep.py +21 -1
  19. pulumi_vault/pulumi-plugin.json +1 -1
  20. pulumi_vault/rabbitmq/secret_backend.py +707 -35
  21. pulumi_vault/ssh/secret_backend_ca.py +101 -7
  22. pulumi_vault/terraformcloud/secret_backend.py +707 -28
  23. pulumi_vault/transit/secret_backend_key.py +49 -21
  24. {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.3.0a1755586140.dist-info}/METADATA +1 -1
  25. {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.3.0a1755586140.dist-info}/RECORD +27 -25
  26. {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.3.0a1755586140.dist-info}/WHEEL +0 -0
  27. {pulumi_vault-7.2.0a1755297899.dist-info → pulumi_vault-7.3.0a1755586140.dist-info}/top_level.txt +0 -0
pulumi_vault/terraformcloud/secret_backend.py CHANGED
@@ -20,43 +20,98 @@ __all__ = ['SecretBackendArgs', 'SecretBackend']
20
20
  class SecretBackendArgs:
21
21
  def __init__(__self__, *,
22
22
  address: Optional[pulumi.Input[_builtins.str]] = None,
23
+ allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
24
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
25
+ audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
26
+ audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
23
27
  backend: Optional[pulumi.Input[_builtins.str]] = None,
24
28
  base_path: Optional[pulumi.Input[_builtins.str]] = None,
25
29
  default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
30
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
26
31
  description: Optional[pulumi.Input[_builtins.str]] = None,
27
32
  disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
33
+ external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
34
+ force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
35
+ identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
36
+ listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
37
+ local: Optional[pulumi.Input[_builtins.bool]] = None,
28
38
  max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
29
39
  namespace: Optional[pulumi.Input[_builtins.str]] = None,
40
+ options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
41
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
42
+ plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
43
+ seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
30
44
  token: Optional[pulumi.Input[_builtins.str]] = None):
31
45
  """
32
46
  The set of arguments for constructing a SecretBackend resource.
33
- :param pulumi.Input[_builtins.int] default_lease_ttl_seconds: The default TTL for credentials issued by this backend.
34
- :param pulumi.Input[_builtins.str] description: A human-friendly description for this backend.
47
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
48
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
49
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
50
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
51
+ :param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
52
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
53
+ :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
35
54
  :param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
36
55
  See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
37
- :param pulumi.Input[_builtins.int] max_lease_ttl_seconds: The maximum TTL that can be requested
38
- for credentials issued by this backend.
56
+ :param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
57
+ :param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
58
+ :param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
59
+ :param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
60
+ :param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
61
+ :param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
39
62
  :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
40
63
  The value should not contain leading or trailing forward slashes.
41
64
  The `namespace` is always relative to the provider's configured namespace.
42
65
  *Available only for Vault Enterprise*.
66
+ :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
67
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
68
+ :param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
69
+ :param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
43
70
  """
44
71
  if address is not None:
45
72
  pulumi.set(__self__, "address", address)
73
+ if allowed_managed_keys is not None:
74
+ pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
75
+ if allowed_response_headers is not None:
76
+ pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
77
+ if audit_non_hmac_request_keys is not None:
78
+ pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
79
+ if audit_non_hmac_response_keys is not None:
80
+ pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
46
81
  if backend is not None:
47
82
  pulumi.set(__self__, "backend", backend)
48
83
  if base_path is not None:
49
84
  pulumi.set(__self__, "base_path", base_path)
50
85
  if default_lease_ttl_seconds is not None:
51
86
  pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
87
+ if delegated_auth_accessors is not None:
88
+ pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
52
89
  if description is not None:
53
90
  pulumi.set(__self__, "description", description)
54
91
  if disable_remount is not None:
55
92
  pulumi.set(__self__, "disable_remount", disable_remount)
93
+ if external_entropy_access is not None:
94
+ pulumi.set(__self__, "external_entropy_access", external_entropy_access)
95
+ if force_no_cache is not None:
96
+ pulumi.set(__self__, "force_no_cache", force_no_cache)
97
+ if identity_token_key is not None:
98
+ pulumi.set(__self__, "identity_token_key", identity_token_key)
99
+ if listing_visibility is not None:
100
+ pulumi.set(__self__, "listing_visibility", listing_visibility)
101
+ if local is not None:
102
+ pulumi.set(__self__, "local", local)
56
103
  if max_lease_ttl_seconds is not None:
57
104
  pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
58
105
  if namespace is not None:
59
106
  pulumi.set(__self__, "namespace", namespace)
107
+ if options is not None:
108
+ pulumi.set(__self__, "options", options)
109
+ if passthrough_request_headers is not None:
110
+ pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
111
+ if plugin_version is not None:
112
+ pulumi.set(__self__, "plugin_version", plugin_version)
113
+ if seal_wrap is not None:
114
+ pulumi.set(__self__, "seal_wrap", seal_wrap)
60
115
  if token is not None:
61
116
  pulumi.set(__self__, "token", token)
62
117
 
@@ -69,6 +124,54 @@ class SecretBackendArgs:
69
124
  def address(self, value: Optional[pulumi.Input[_builtins.str]]):
70
125
  pulumi.set(self, "address", value)
71
126
 
127
+ @_builtins.property
128
+ @pulumi.getter(name="allowedManagedKeys")
129
+ def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
130
+ """
131
+ List of managed key registry entry names that the mount in question is allowed to access
132
+ """
133
+ return pulumi.get(self, "allowed_managed_keys")
134
+
135
+ @allowed_managed_keys.setter
136
+ def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
137
+ pulumi.set(self, "allowed_managed_keys", value)
138
+
139
+ @_builtins.property
140
+ @pulumi.getter(name="allowedResponseHeaders")
141
+ def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
142
+ """
143
+ List of headers to allow and pass from the request to the plugin
144
+ """
145
+ return pulumi.get(self, "allowed_response_headers")
146
+
147
+ @allowed_response_headers.setter
148
+ def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
149
+ pulumi.set(self, "allowed_response_headers", value)
150
+
151
+ @_builtins.property
152
+ @pulumi.getter(name="auditNonHmacRequestKeys")
153
+ def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
154
+ """
155
+ Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
156
+ """
157
+ return pulumi.get(self, "audit_non_hmac_request_keys")
158
+
159
+ @audit_non_hmac_request_keys.setter
160
+ def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
161
+ pulumi.set(self, "audit_non_hmac_request_keys", value)
162
+
163
+ @_builtins.property
164
+ @pulumi.getter(name="auditNonHmacResponseKeys")
165
+ def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
166
+ """
167
+ Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
168
+ """
169
+ return pulumi.get(self, "audit_non_hmac_response_keys")
170
+
171
+ @audit_non_hmac_response_keys.setter
172
+ def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
173
+ pulumi.set(self, "audit_non_hmac_response_keys", value)
174
+
72
175
  @_builtins.property
73
176
  @pulumi.getter
74
177
  def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -91,7 +194,7 @@ class SecretBackendArgs:
91
194
  @pulumi.getter(name="defaultLeaseTtlSeconds")
92
195
  def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
93
196
  """
94
- The default TTL for credentials issued by this backend.
197
+ Default lease duration for secrets in seconds
95
198
  """
96
199
  return pulumi.get(self, "default_lease_ttl_seconds")
97
200
 
@@ -99,11 +202,23 @@ class SecretBackendArgs:
99
202
  def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
100
203
  pulumi.set(self, "default_lease_ttl_seconds", value)
101
204
 
205
+ @_builtins.property
206
+ @pulumi.getter(name="delegatedAuthAccessors")
207
+ def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
208
+ """
209
+ List of headers to allow and pass from the request to the plugin
210
+ """
211
+ return pulumi.get(self, "delegated_auth_accessors")
212
+
213
+ @delegated_auth_accessors.setter
214
+ def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
215
+ pulumi.set(self, "delegated_auth_accessors", value)
216
+
102
217
  @_builtins.property
103
218
  @pulumi.getter
104
219
  def description(self) -> Optional[pulumi.Input[_builtins.str]]:
105
220
  """
106
- A human-friendly description for this backend.
221
+ Human-friendly description of the mount for the backend.
107
222
  """
108
223
  return pulumi.get(self, "description")
109
224
 
@@ -124,12 +239,71 @@ class SecretBackendArgs:
124
239
  def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
125
240
  pulumi.set(self, "disable_remount", value)
126
241
 
242
+ @_builtins.property
243
+ @pulumi.getter(name="externalEntropyAccess")
244
+ def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
245
+ """
246
+ Enable the secrets engine to access Vault's external entropy source
247
+ """
248
+ return pulumi.get(self, "external_entropy_access")
249
+
250
+ @external_entropy_access.setter
251
+ def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
252
+ pulumi.set(self, "external_entropy_access", value)
253
+
254
+ @_builtins.property
255
+ @pulumi.getter(name="forceNoCache")
256
+ def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
257
+ """
258
+ If set to true, disables caching.
259
+ """
260
+ return pulumi.get(self, "force_no_cache")
261
+
262
+ @force_no_cache.setter
263
+ def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
264
+ pulumi.set(self, "force_no_cache", value)
265
+
266
+ @_builtins.property
267
+ @pulumi.getter(name="identityTokenKey")
268
+ def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
269
+ """
270
+ The key to use for signing plugin workload identity tokens
271
+ """
272
+ return pulumi.get(self, "identity_token_key")
273
+
274
+ @identity_token_key.setter
275
+ def identity_token_key(self, value: Optional[pulumi.Input[_builtins.str]]):
276
+ pulumi.set(self, "identity_token_key", value)
277
+
278
+ @_builtins.property
279
+ @pulumi.getter(name="listingVisibility")
280
+ def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
281
+ """
282
+ Specifies whether to show this mount in the UI-specific listing endpoint
283
+ """
284
+ return pulumi.get(self, "listing_visibility")
285
+
286
+ @listing_visibility.setter
287
+ def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
288
+ pulumi.set(self, "listing_visibility", value)
289
+
290
+ @_builtins.property
291
+ @pulumi.getter
292
+ def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
293
+ """
294
+ Local mount flag that can be explicitly set to true to enforce local mount in HA environment
295
+ """
296
+ return pulumi.get(self, "local")
297
+
298
+ @local.setter
299
+ def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
300
+ pulumi.set(self, "local", value)
301
+
127
302
  @_builtins.property
128
303
  @pulumi.getter(name="maxLeaseTtlSeconds")
129
304
  def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
130
305
  """
131
- The maximum TTL that can be requested
132
- for credentials issued by this backend.
306
+ Maximum possible lease duration for secrets in seconds
133
307
  """
134
308
  return pulumi.get(self, "max_lease_ttl_seconds")
135
309
 
@@ -152,6 +326,54 @@ class SecretBackendArgs:
152
326
  def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
153
327
  pulumi.set(self, "namespace", value)
154
328
 
329
+ @_builtins.property
330
+ @pulumi.getter
331
+ def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
332
+ """
333
+ Specifies mount type specific options that are passed to the backend
334
+ """
335
+ return pulumi.get(self, "options")
336
+
337
+ @options.setter
338
+ def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
339
+ pulumi.set(self, "options", value)
340
+
341
+ @_builtins.property
342
+ @pulumi.getter(name="passthroughRequestHeaders")
343
+ def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
344
+ """
345
+ List of headers to allow and pass from the request to the plugin
346
+ """
347
+ return pulumi.get(self, "passthrough_request_headers")
348
+
349
+ @passthrough_request_headers.setter
350
+ def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
351
+ pulumi.set(self, "passthrough_request_headers", value)
352
+
353
+ @_builtins.property
354
+ @pulumi.getter(name="pluginVersion")
355
+ def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
356
+ """
357
+ Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
358
+ """
359
+ return pulumi.get(self, "plugin_version")
360
+
361
+ @plugin_version.setter
362
+ def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
363
+ pulumi.set(self, "plugin_version", value)
364
+
365
+ @_builtins.property
366
+ @pulumi.getter(name="sealWrap")
367
+ def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
368
+ """
369
+ Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
370
+ """
371
+ return pulumi.get(self, "seal_wrap")
372
+
373
+ @seal_wrap.setter
374
+ def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
375
+ pulumi.set(self, "seal_wrap", value)
376
+
155
377
  @_builtins.property
156
378
  @pulumi.getter
157
379
  def token(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -165,47 +387,118 @@ class SecretBackendArgs:
165
387
  @pulumi.input_type
166
388
  class _SecretBackendState:
167
389
  def __init__(__self__, *,
390
+ accessor: Optional[pulumi.Input[_builtins.str]] = None,
168
391
  address: Optional[pulumi.Input[_builtins.str]] = None,
392
+ allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
393
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
394
+ audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
395
+ audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
169
396
  backend: Optional[pulumi.Input[_builtins.str]] = None,
170
397
  base_path: Optional[pulumi.Input[_builtins.str]] = None,
171
398
  default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
399
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
172
400
  description: Optional[pulumi.Input[_builtins.str]] = None,
173
401
  disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
402
+ external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
403
+ force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
404
+ identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
405
+ listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
406
+ local: Optional[pulumi.Input[_builtins.bool]] = None,
174
407
  max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
175
408
  namespace: Optional[pulumi.Input[_builtins.str]] = None,
409
+ options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
410
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
411
+ plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
412
+ seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
176
413
  token: Optional[pulumi.Input[_builtins.str]] = None):
177
414
  """
178
415
  Input properties used for looking up and filtering SecretBackend resources.
179
- :param pulumi.Input[_builtins.int] default_lease_ttl_seconds: The default TTL for credentials issued by this backend.
180
- :param pulumi.Input[_builtins.str] description: A human-friendly description for this backend.
416
+ :param pulumi.Input[_builtins.str] accessor: Accessor of the mount
417
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
418
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
419
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
420
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
421
+ :param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
422
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
423
+ :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
181
424
  :param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
182
425
  See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
183
- :param pulumi.Input[_builtins.int] max_lease_ttl_seconds: The maximum TTL that can be requested
184
- for credentials issued by this backend.
426
+ :param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
427
+ :param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
428
+ :param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
429
+ :param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
430
+ :param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
431
+ :param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
185
432
  :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
186
433
  The value should not contain leading or trailing forward slashes.
187
434
  The `namespace` is always relative to the provider's configured namespace.
188
435
  *Available only for Vault Enterprise*.
436
+ :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
437
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
438
+ :param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
439
+ :param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
189
440
  """
441
+ if accessor is not None:
442
+ pulumi.set(__self__, "accessor", accessor)
190
443
  if address is not None:
191
444
  pulumi.set(__self__, "address", address)
445
+ if allowed_managed_keys is not None:
446
+ pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
447
+ if allowed_response_headers is not None:
448
+ pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
449
+ if audit_non_hmac_request_keys is not None:
450
+ pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
451
+ if audit_non_hmac_response_keys is not None:
452
+ pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
192
453
  if backend is not None:
193
454
  pulumi.set(__self__, "backend", backend)
194
455
  if base_path is not None:
195
456
  pulumi.set(__self__, "base_path", base_path)
196
457
  if default_lease_ttl_seconds is not None:
197
458
  pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
459
+ if delegated_auth_accessors is not None:
460
+ pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
198
461
  if description is not None:
199
462
  pulumi.set(__self__, "description", description)
200
463
  if disable_remount is not None:
201
464
  pulumi.set(__self__, "disable_remount", disable_remount)
465
+ if external_entropy_access is not None:
466
+ pulumi.set(__self__, "external_entropy_access", external_entropy_access)
467
+ if force_no_cache is not None:
468
+ pulumi.set(__self__, "force_no_cache", force_no_cache)
469
+ if identity_token_key is not None:
470
+ pulumi.set(__self__, "identity_token_key", identity_token_key)
471
+ if listing_visibility is not None:
472
+ pulumi.set(__self__, "listing_visibility", listing_visibility)
473
+ if local is not None:
474
+ pulumi.set(__self__, "local", local)
202
475
  if max_lease_ttl_seconds is not None:
203
476
  pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
204
477
  if namespace is not None:
205
478
  pulumi.set(__self__, "namespace", namespace)
479
+ if options is not None:
480
+ pulumi.set(__self__, "options", options)
481
+ if passthrough_request_headers is not None:
482
+ pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
483
+ if plugin_version is not None:
484
+ pulumi.set(__self__, "plugin_version", plugin_version)
485
+ if seal_wrap is not None:
486
+ pulumi.set(__self__, "seal_wrap", seal_wrap)
206
487
  if token is not None:
207
488
  pulumi.set(__self__, "token", token)
208
489
 
490
+ @_builtins.property
491
+ @pulumi.getter
492
+ def accessor(self) -> Optional[pulumi.Input[_builtins.str]]:
493
+ """
494
+ Accessor of the mount
495
+ """
496
+ return pulumi.get(self, "accessor")
497
+
498
+ @accessor.setter
499
+ def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
500
+ pulumi.set(self, "accessor", value)
501
+
209
502
  @_builtins.property
210
503
  @pulumi.getter
211
504
  def address(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -215,6 +508,54 @@ class _SecretBackendState:
215
508
  def address(self, value: Optional[pulumi.Input[_builtins.str]]):
216
509
  pulumi.set(self, "address", value)
217
510
 
511
+ @_builtins.property
512
+ @pulumi.getter(name="allowedManagedKeys")
513
+ def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
514
+ """
515
+ List of managed key registry entry names that the mount in question is allowed to access
516
+ """
517
+ return pulumi.get(self, "allowed_managed_keys")
518
+
519
+ @allowed_managed_keys.setter
520
+ def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
521
+ pulumi.set(self, "allowed_managed_keys", value)
522
+
523
+ @_builtins.property
524
+ @pulumi.getter(name="allowedResponseHeaders")
525
+ def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
526
+ """
527
+ List of headers to allow and pass from the request to the plugin
528
+ """
529
+ return pulumi.get(self, "allowed_response_headers")
530
+
531
+ @allowed_response_headers.setter
532
+ def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
533
+ pulumi.set(self, "allowed_response_headers", value)
534
+
535
+ @_builtins.property
536
+ @pulumi.getter(name="auditNonHmacRequestKeys")
537
+ def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
538
+ """
539
+ Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
540
+ """
541
+ return pulumi.get(self, "audit_non_hmac_request_keys")
542
+
543
+ @audit_non_hmac_request_keys.setter
544
+ def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
545
+ pulumi.set(self, "audit_non_hmac_request_keys", value)
546
+
547
+ @_builtins.property
548
+ @pulumi.getter(name="auditNonHmacResponseKeys")
549
+ def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
550
+ """
551
+ Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
552
+ """
553
+ return pulumi.get(self, "audit_non_hmac_response_keys")
554
+
555
+ @audit_non_hmac_response_keys.setter
556
+ def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
557
+ pulumi.set(self, "audit_non_hmac_response_keys", value)
558
+
218
559
  @_builtins.property
219
560
  @pulumi.getter
220
561
  def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -237,7 +578,7 @@ class _SecretBackendState:
237
578
  @pulumi.getter(name="defaultLeaseTtlSeconds")
238
579
  def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
239
580
  """
240
- The default TTL for credentials issued by this backend.
581
+ Default lease duration for secrets in seconds
241
582
  """
242
583
  return pulumi.get(self, "default_lease_ttl_seconds")
243
584
 
@@ -245,11 +586,23 @@ class _SecretBackendState:
245
586
  def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
246
587
  pulumi.set(self, "default_lease_ttl_seconds", value)
247
588
 
589
+ @_builtins.property
590
+ @pulumi.getter(name="delegatedAuthAccessors")
591
+ def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
592
+ """
593
+ List of headers to allow and pass from the request to the plugin
594
+ """
595
+ return pulumi.get(self, "delegated_auth_accessors")
596
+
597
+ @delegated_auth_accessors.setter
598
+ def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
599
+ pulumi.set(self, "delegated_auth_accessors", value)
600
+
248
601
  @_builtins.property
249
602
  @pulumi.getter
250
603
  def description(self) -> Optional[pulumi.Input[_builtins.str]]:
251
604
  """
252
- A human-friendly description for this backend.
605
+ Human-friendly description of the mount for the backend.
253
606
  """
254
607
  return pulumi.get(self, "description")
255
608
 
@@ -270,12 +623,71 @@ class _SecretBackendState:
270
623
  def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
271
624
  pulumi.set(self, "disable_remount", value)
272
625
 
626
+ @_builtins.property
627
+ @pulumi.getter(name="externalEntropyAccess")
628
+ def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
629
+ """
630
+ Enable the secrets engine to access Vault's external entropy source
631
+ """
632
+ return pulumi.get(self, "external_entropy_access")
633
+
634
+ @external_entropy_access.setter
635
+ def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
636
+ pulumi.set(self, "external_entropy_access", value)
637
+
638
+ @_builtins.property
639
+ @pulumi.getter(name="forceNoCache")
640
+ def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
641
+ """
642
+ If set to true, disables caching.
643
+ """
644
+ return pulumi.get(self, "force_no_cache")
645
+
646
+ @force_no_cache.setter
647
+ def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
648
+ pulumi.set(self, "force_no_cache", value)
649
+
650
+ @_builtins.property
651
+ @pulumi.getter(name="identityTokenKey")
652
+ def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
653
+ """
654
+ The key to use for signing plugin workload identity tokens
655
+ """
656
+ return pulumi.get(self, "identity_token_key")
657
+
658
+ @identity_token_key.setter
659
+ def identity_token_key(self, value: Optional[pulumi.Input[_builtins.str]]):
660
+ pulumi.set(self, "identity_token_key", value)
661
+
662
+ @_builtins.property
663
+ @pulumi.getter(name="listingVisibility")
664
+ def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
665
+ """
666
+ Specifies whether to show this mount in the UI-specific listing endpoint
667
+ """
668
+ return pulumi.get(self, "listing_visibility")
669
+
670
+ @listing_visibility.setter
671
+ def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
672
+ pulumi.set(self, "listing_visibility", value)
673
+
674
+ @_builtins.property
675
+ @pulumi.getter
676
+ def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
677
+ """
678
+ Local mount flag that can be explicitly set to true to enforce local mount in HA environment
679
+ """
680
+ return pulumi.get(self, "local")
681
+
682
+ @local.setter
683
+ def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
684
+ pulumi.set(self, "local", value)
685
+
273
686
  @_builtins.property
274
687
  @pulumi.getter(name="maxLeaseTtlSeconds")
275
688
  def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
276
689
  """
277
- The maximum TTL that can be requested
278
- for credentials issued by this backend.
690
+ Maximum possible lease duration for secrets in seconds
279
691
  """
280
692
  return pulumi.get(self, "max_lease_ttl_seconds")
281
693
 
@@ -298,6 +710,54 @@ class _SecretBackendState:
298
710
  def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
299
711
  pulumi.set(self, "namespace", value)
300
712
 
713
+ @_builtins.property
714
+ @pulumi.getter
715
+ def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
716
+ """
717
+ Specifies mount type specific options that are passed to the backend
718
+ """
719
+ return pulumi.get(self, "options")
720
+
721
+ @options.setter
722
+ def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
723
+ pulumi.set(self, "options", value)
724
+
725
+ @_builtins.property
726
+ @pulumi.getter(name="passthroughRequestHeaders")
727
+ def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
728
+ """
729
+ List of headers to allow and pass from the request to the plugin
730
+ """
731
+ return pulumi.get(self, "passthrough_request_headers")
732
+
733
+ @passthrough_request_headers.setter
734
+ def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
735
+ pulumi.set(self, "passthrough_request_headers", value)
736
+
737
+ @_builtins.property
738
+ @pulumi.getter(name="pluginVersion")
739
+ def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
740
+ """
741
+ Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
742
+ """
743
+ return pulumi.get(self, "plugin_version")
744
+
745
+ @plugin_version.setter
746
+ def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
747
+ pulumi.set(self, "plugin_version", value)
748
+
749
+ @_builtins.property
750
+ @pulumi.getter(name="sealWrap")
751
+ def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
752
+ """
753
+ Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
754
+ """
755
+ return pulumi.get(self, "seal_wrap")
756
+
757
+ @seal_wrap.setter
758
+ def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
759
+ pulumi.set(self, "seal_wrap", value)
760
+
301
761
  @_builtins.property
302
762
  @pulumi.getter
303
763
  def token(self) -> Optional[pulumi.Input[_builtins.str]]:
@@ -315,13 +775,27 @@ class SecretBackend(pulumi.CustomResource):
315
775
  resource_name: str,
316
776
  opts: Optional[pulumi.ResourceOptions] = None,
317
777
  address: Optional[pulumi.Input[_builtins.str]] = None,
778
+ allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
779
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
780
+ audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
781
+ audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
318
782
  backend: Optional[pulumi.Input[_builtins.str]] = None,
319
783
  base_path: Optional[pulumi.Input[_builtins.str]] = None,
320
784
  default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
785
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
321
786
  description: Optional[pulumi.Input[_builtins.str]] = None,
322
787
  disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
788
+ external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
789
+ force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
790
+ identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
791
+ listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
792
+ local: Optional[pulumi.Input[_builtins.bool]] = None,
323
793
  max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
324
794
  namespace: Optional[pulumi.Input[_builtins.str]] = None,
795
+ options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
796
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
797
+ plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
798
+ seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
325
799
  token: Optional[pulumi.Input[_builtins.str]] = None,
326
800
  __props__=None):
327
801
  """
@@ -347,16 +821,29 @@ class SecretBackend(pulumi.CustomResource):
347
821
 
348
822
  :param str resource_name: The name of the resource.
349
823
  :param pulumi.ResourceOptions opts: Options for the resource.
350
- :param pulumi.Input[_builtins.int] default_lease_ttl_seconds: The default TTL for credentials issued by this backend.
351
- :param pulumi.Input[_builtins.str] description: A human-friendly description for this backend.
824
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
825
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
826
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
827
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
828
+ :param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
829
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
830
+ :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
352
831
  :param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
353
832
  See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
354
- :param pulumi.Input[_builtins.int] max_lease_ttl_seconds: The maximum TTL that can be requested
355
- for credentials issued by this backend.
833
+ :param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
834
+ :param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
835
+ :param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
836
+ :param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
837
+ :param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
838
+ :param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
356
839
  :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
357
840
  The value should not contain leading or trailing forward slashes.
358
841
  The `namespace` is always relative to the provider's configured namespace.
359
842
  *Available only for Vault Enterprise*.
843
+ :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
844
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
845
+ :param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
846
+ :param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
360
847
  """
361
848
  ...
362
849
  @overload
@@ -401,13 +888,27 @@ class SecretBackend(pulumi.CustomResource):
401
888
  resource_name: str,
402
889
  opts: Optional[pulumi.ResourceOptions] = None,
403
890
  address: Optional[pulumi.Input[_builtins.str]] = None,
891
+ allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
892
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
893
+ audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
894
+ audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
404
895
  backend: Optional[pulumi.Input[_builtins.str]] = None,
405
896
  base_path: Optional[pulumi.Input[_builtins.str]] = None,
406
897
  default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
898
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
407
899
  description: Optional[pulumi.Input[_builtins.str]] = None,
408
900
  disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
901
+ external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
902
+ force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
903
+ identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
904
+ listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
905
+ local: Optional[pulumi.Input[_builtins.bool]] = None,
409
906
  max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
410
907
  namespace: Optional[pulumi.Input[_builtins.str]] = None,
908
+ options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
909
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
910
+ plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
911
+ seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
411
912
  token: Optional[pulumi.Input[_builtins.str]] = None,
412
913
  __props__=None):
413
914
  opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
@@ -419,14 +920,29 @@ class SecretBackend(pulumi.CustomResource):
419
920
  __props__ = SecretBackendArgs.__new__(SecretBackendArgs)
420
921
 
421
922
  __props__.__dict__["address"] = address
923
+ __props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
924
+ __props__.__dict__["allowed_response_headers"] = allowed_response_headers
925
+ __props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
926
+ __props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
422
927
  __props__.__dict__["backend"] = backend
423
928
  __props__.__dict__["base_path"] = base_path
424
929
  __props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
930
+ __props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
425
931
  __props__.__dict__["description"] = description
426
932
  __props__.__dict__["disable_remount"] = disable_remount
933
+ __props__.__dict__["external_entropy_access"] = external_entropy_access
934
+ __props__.__dict__["force_no_cache"] = force_no_cache
935
+ __props__.__dict__["identity_token_key"] = identity_token_key
936
+ __props__.__dict__["listing_visibility"] = listing_visibility
937
+ __props__.__dict__["local"] = local
427
938
  __props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
428
939
  __props__.__dict__["namespace"] = namespace
940
+ __props__.__dict__["options"] = options
941
+ __props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
942
+ __props__.__dict__["plugin_version"] = plugin_version
943
+ __props__.__dict__["seal_wrap"] = seal_wrap
429
944
  __props__.__dict__["token"] = None if token is None else pulumi.Output.secret(token)
945
+ __props__.__dict__["accessor"] = None
430
946
  secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["token"])
431
947
  opts = pulumi.ResourceOptions.merge(opts, secret_opts)
432
948
  super(SecretBackend, __self__).__init__(
@@ -439,14 +955,29 @@ class SecretBackend(pulumi.CustomResource):
439
955
  def get(resource_name: str,
440
956
  id: pulumi.Input[str],
441
957
  opts: Optional[pulumi.ResourceOptions] = None,
958
+ accessor: Optional[pulumi.Input[_builtins.str]] = None,
442
959
  address: Optional[pulumi.Input[_builtins.str]] = None,
960
+ allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
961
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
962
+ audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
963
+ audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
443
964
  backend: Optional[pulumi.Input[_builtins.str]] = None,
444
965
  base_path: Optional[pulumi.Input[_builtins.str]] = None,
445
966
  default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
967
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
446
968
  description: Optional[pulumi.Input[_builtins.str]] = None,
447
969
  disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
970
+ external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
971
+ force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
972
+ identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
973
+ listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
974
+ local: Optional[pulumi.Input[_builtins.bool]] = None,
448
975
  max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
449
976
  namespace: Optional[pulumi.Input[_builtins.str]] = None,
977
+ options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
978
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
979
+ plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
980
+ seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
450
981
  token: Optional[pulumi.Input[_builtins.str]] = None) -> 'SecretBackend':
451
982
  """
452
983
  Get an existing SecretBackend resource's state with the given name, id, and optional extra
@@ -455,37 +986,106 @@ class SecretBackend(pulumi.CustomResource):
455
986
  :param str resource_name: The unique name of the resulting resource.
456
987
  :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
457
988
  :param pulumi.ResourceOptions opts: Options for the resource.
458
- :param pulumi.Input[_builtins.int] default_lease_ttl_seconds: The default TTL for credentials issued by this backend.
459
- :param pulumi.Input[_builtins.str] description: A human-friendly description for this backend.
989
+ :param pulumi.Input[_builtins.str] accessor: Accessor of the mount
990
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
991
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
992
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
993
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
994
+ :param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
995
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
996
+ :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
460
997
  :param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
461
998
  See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
462
- :param pulumi.Input[_builtins.int] max_lease_ttl_seconds: The maximum TTL that can be requested
463
- for credentials issued by this backend.
999
+ :param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
1000
+ :param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
1001
+ :param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
1002
+ :param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
1003
+ :param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
1004
+ :param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
464
1005
  :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
465
1006
  The value should not contain leading or trailing forward slashes.
466
1007
  The `namespace` is always relative to the provider's configured namespace.
467
1008
  *Available only for Vault Enterprise*.
1009
+ :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
1010
+ :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
1011
+ :param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
1012
+ :param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
468
1013
  """
469
1014
  opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
470
1015
 
471
1016
  __props__ = _SecretBackendState.__new__(_SecretBackendState)
472
1017
 
1018
+ __props__.__dict__["accessor"] = accessor
473
1019
  __props__.__dict__["address"] = address
1020
+ __props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
1021
+ __props__.__dict__["allowed_response_headers"] = allowed_response_headers
1022
+ __props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
1023
+ __props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
474
1024
  __props__.__dict__["backend"] = backend
475
1025
  __props__.__dict__["base_path"] = base_path
476
1026
  __props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
1027
+ __props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
477
1028
  __props__.__dict__["description"] = description
478
1029
  __props__.__dict__["disable_remount"] = disable_remount
1030
+ __props__.__dict__["external_entropy_access"] = external_entropy_access
1031
+ __props__.__dict__["force_no_cache"] = force_no_cache
1032
+ __props__.__dict__["identity_token_key"] = identity_token_key
1033
+ __props__.__dict__["listing_visibility"] = listing_visibility
1034
+ __props__.__dict__["local"] = local
479
1035
  __props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
480
1036
  __props__.__dict__["namespace"] = namespace
1037
+ __props__.__dict__["options"] = options
1038
+ __props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
1039
+ __props__.__dict__["plugin_version"] = plugin_version
1040
+ __props__.__dict__["seal_wrap"] = seal_wrap
481
1041
  __props__.__dict__["token"] = token
482
1042
  return SecretBackend(resource_name, opts=opts, __props__=__props__)
483
1043
 
1044
+ @_builtins.property
1045
+ @pulumi.getter
1046
+ def accessor(self) -> pulumi.Output[_builtins.str]:
1047
+ """
1048
+ Accessor of the mount
1049
+ """
1050
+ return pulumi.get(self, "accessor")
1051
+
484
1052
  @_builtins.property
485
1053
  @pulumi.getter
486
1054
  def address(self) -> pulumi.Output[Optional[_builtins.str]]:
487
1055
  return pulumi.get(self, "address")
488
1056
 
1057
+ @_builtins.property
1058
+ @pulumi.getter(name="allowedManagedKeys")
1059
+ def allowed_managed_keys(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
1060
+ """
1061
+ List of managed key registry entry names that the mount in question is allowed to access
1062
+ """
1063
+ return pulumi.get(self, "allowed_managed_keys")
1064
+
1065
+ @_builtins.property
1066
+ @pulumi.getter(name="allowedResponseHeaders")
1067
+ def allowed_response_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
1068
+ """
1069
+ List of headers to allow and pass from the request to the plugin
1070
+ """
1071
+ return pulumi.get(self, "allowed_response_headers")
1072
+
1073
+ @_builtins.property
1074
+ @pulumi.getter(name="auditNonHmacRequestKeys")
1075
+ def audit_non_hmac_request_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
1076
+ """
1077
+ Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
1078
+ """
1079
+ return pulumi.get(self, "audit_non_hmac_request_keys")
1080
+
1081
+ @_builtins.property
1082
+ @pulumi.getter(name="auditNonHmacResponseKeys")
1083
+ def audit_non_hmac_response_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
1084
+ """
1085
+ Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
1086
+ """
1087
+ return pulumi.get(self, "audit_non_hmac_response_keys")
1088
+
489
1089
  @_builtins.property
490
1090
  @pulumi.getter
491
1091
  def backend(self) -> pulumi.Output[Optional[_builtins.str]]:
@@ -500,15 +1100,23 @@ class SecretBackend(pulumi.CustomResource):
500
1100
  @pulumi.getter(name="defaultLeaseTtlSeconds")
501
1101
  def default_lease_ttl_seconds(self) -> pulumi.Output[Optional[_builtins.int]]:
502
1102
  """
503
- The default TTL for credentials issued by this backend.
1103
+ Default lease duration for secrets in seconds
504
1104
  """
505
1105
  return pulumi.get(self, "default_lease_ttl_seconds")
506
1106
 
1107
+ @_builtins.property
1108
+ @pulumi.getter(name="delegatedAuthAccessors")
1109
+ def delegated_auth_accessors(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
1110
+ """
1111
+ List of headers to allow and pass from the request to the plugin
1112
+ """
1113
+ return pulumi.get(self, "delegated_auth_accessors")
1114
+
507
1115
  @_builtins.property
508
1116
  @pulumi.getter
509
1117
  def description(self) -> pulumi.Output[Optional[_builtins.str]]:
510
1118
  """
511
- A human-friendly description for this backend.
1119
+ Human-friendly description of the mount for the backend.
512
1120
  """
513
1121
  return pulumi.get(self, "description")
514
1122
 
@@ -521,12 +1129,51 @@ class SecretBackend(pulumi.CustomResource):
521
1129
  """
522
1130
  return pulumi.get(self, "disable_remount")
523
1131
 
1132
+ @_builtins.property
1133
+ @pulumi.getter(name="externalEntropyAccess")
1134
+ def external_entropy_access(self) -> pulumi.Output[Optional[_builtins.bool]]:
1135
+ """
1136
+ Enable the secrets engine to access Vault's external entropy source
1137
+ """
1138
+ return pulumi.get(self, "external_entropy_access")
1139
+
1140
+ @_builtins.property
1141
+ @pulumi.getter(name="forceNoCache")
1142
+ def force_no_cache(self) -> pulumi.Output[_builtins.bool]:
1143
+ """
1144
+ If set to true, disables caching.
1145
+ """
1146
+ return pulumi.get(self, "force_no_cache")
1147
+
1148
+ @_builtins.property
1149
+ @pulumi.getter(name="identityTokenKey")
1150
+ def identity_token_key(self) -> pulumi.Output[Optional[_builtins.str]]:
1151
+ """
1152
+ The key to use for signing plugin workload identity tokens
1153
+ """
1154
+ return pulumi.get(self, "identity_token_key")
1155
+
1156
+ @_builtins.property
1157
+ @pulumi.getter(name="listingVisibility")
1158
+ def listing_visibility(self) -> pulumi.Output[Optional[_builtins.str]]:
1159
+ """
1160
+ Specifies whether to show this mount in the UI-specific listing endpoint
1161
+ """
1162
+ return pulumi.get(self, "listing_visibility")
1163
+
1164
+ @_builtins.property
1165
+ @pulumi.getter
1166
+ def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
1167
+ """
1168
+ Local mount flag that can be explicitly set to true to enforce local mount in HA environment
1169
+ """
1170
+ return pulumi.get(self, "local")
1171
+
524
1172
  @_builtins.property
525
1173
  @pulumi.getter(name="maxLeaseTtlSeconds")
526
1174
  def max_lease_ttl_seconds(self) -> pulumi.Output[Optional[_builtins.int]]:
527
1175
  """
528
- The maximum TTL that can be requested
529
- for credentials issued by this backend.
1176
+ Maximum possible lease duration for secrets in seconds
530
1177
  """
531
1178
  return pulumi.get(self, "max_lease_ttl_seconds")
532
1179
 
@@ -541,6 +1188,38 @@ class SecretBackend(pulumi.CustomResource):
541
1188
  """
542
1189
  return pulumi.get(self, "namespace")
543
1190
 
1191
+ @_builtins.property
1192
+ @pulumi.getter
1193
+ def options(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
1194
+ """
1195
+ Specifies mount type specific options that are passed to the backend
1196
+ """
1197
+ return pulumi.get(self, "options")
1198
+
1199
+ @_builtins.property
1200
+ @pulumi.getter(name="passthroughRequestHeaders")
1201
+ def passthrough_request_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
1202
+ """
1203
+ List of headers to allow and pass from the request to the plugin
1204
+ """
1205
+ return pulumi.get(self, "passthrough_request_headers")
1206
+
1207
+ @_builtins.property
1208
+ @pulumi.getter(name="pluginVersion")
1209
+ def plugin_version(self) -> pulumi.Output[Optional[_builtins.str]]:
1210
+ """
1211
+ Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
1212
+ """
1213
+ return pulumi.get(self, "plugin_version")
1214
+
1215
+ @_builtins.property
1216
+ @pulumi.getter(name="sealWrap")
1217
+ def seal_wrap(self) -> pulumi.Output[_builtins.bool]:
1218
+ """
1219
+ Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
1220
+ """
1221
+ return pulumi.get(self, "seal_wrap")
1222
+
544
1223
  @_builtins.property
545
1224
  @pulumi.getter
546
1225
  def token(self) -> pulumi.Output[Optional[_builtins.str]]: