pulumi-vault 7.6.0a1764657486__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +1399 -0
- pulumi_vault/_inputs.py +2701 -0
- pulumi_vault/_utilities.py +331 -0
- pulumi_vault/ad/__init__.py +12 -0
- pulumi_vault/ad/get_access_credentials.py +177 -0
- pulumi_vault/ad/secret_backend.py +1916 -0
- pulumi_vault/ad/secret_library.py +546 -0
- pulumi_vault/ad/secret_role.py +499 -0
- pulumi_vault/alicloud/__init__.py +9 -0
- pulumi_vault/alicloud/auth_backend_role.py +866 -0
- pulumi_vault/approle/__init__.py +12 -0
- pulumi_vault/approle/auth_backend_login.py +571 -0
- pulumi_vault/approle/auth_backend_role.py +1082 -0
- pulumi_vault/approle/auth_backend_role_secret_id.py +796 -0
- pulumi_vault/approle/get_auth_backend_role_id.py +169 -0
- pulumi_vault/audit.py +499 -0
- pulumi_vault/audit_request_header.py +277 -0
- pulumi_vault/auth_backend.py +565 -0
- pulumi_vault/aws/__init__.py +22 -0
- pulumi_vault/aws/auth_backend_cert.py +420 -0
- pulumi_vault/aws/auth_backend_client.py +1259 -0
- pulumi_vault/aws/auth_backend_config_identity.py +494 -0
- pulumi_vault/aws/auth_backend_identity_whitelist.py +380 -0
- pulumi_vault/aws/auth_backend_login.py +1046 -0
- pulumi_vault/aws/auth_backend_role.py +1961 -0
- pulumi_vault/aws/auth_backend_role_tag.py +638 -0
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +366 -0
- pulumi_vault/aws/auth_backend_sts_role.py +414 -0
- pulumi_vault/aws/get_access_credentials.py +369 -0
- pulumi_vault/aws/get_static_access_credentials.py +137 -0
- pulumi_vault/aws/secret_backend.py +2018 -0
- pulumi_vault/aws/secret_backend_role.py +1188 -0
- pulumi_vault/aws/secret_backend_static_role.py +639 -0
- pulumi_vault/azure/__init__.py +15 -0
- pulumi_vault/azure/_inputs.py +108 -0
- pulumi_vault/azure/auth_backend_config.py +1096 -0
- pulumi_vault/azure/auth_backend_role.py +1176 -0
- pulumi_vault/azure/backend.py +1793 -0
- pulumi_vault/azure/backend_role.py +883 -0
- pulumi_vault/azure/get_access_credentials.py +400 -0
- pulumi_vault/azure/outputs.py +107 -0
- pulumi_vault/cert_auth_backend_role.py +1539 -0
- pulumi_vault/config/__init__.py +9 -0
- pulumi_vault/config/__init__.pyi +164 -0
- pulumi_vault/config/_inputs.py +73 -0
- pulumi_vault/config/outputs.py +1225 -0
- pulumi_vault/config/ui_custom_message.py +530 -0
- pulumi_vault/config/vars.py +230 -0
- pulumi_vault/consul/__init__.py +10 -0
- pulumi_vault/consul/secret_backend.py +1517 -0
- pulumi_vault/consul/secret_backend_role.py +847 -0
- pulumi_vault/database/__init__.py +14 -0
- pulumi_vault/database/_inputs.py +11907 -0
- pulumi_vault/database/outputs.py +8496 -0
- pulumi_vault/database/secret_backend_connection.py +1676 -0
- pulumi_vault/database/secret_backend_role.py +840 -0
- pulumi_vault/database/secret_backend_static_role.py +881 -0
- pulumi_vault/database/secrets_mount.py +2160 -0
- pulumi_vault/egp_policy.py +399 -0
- pulumi_vault/gcp/__init__.py +17 -0
- pulumi_vault/gcp/_inputs.py +441 -0
- pulumi_vault/gcp/auth_backend.py +1486 -0
- pulumi_vault/gcp/auth_backend_role.py +1235 -0
- pulumi_vault/gcp/get_auth_backend_role.py +514 -0
- pulumi_vault/gcp/outputs.py +302 -0
- pulumi_vault/gcp/secret_backend.py +1807 -0
- pulumi_vault/gcp/secret_impersonated_account.py +484 -0
- pulumi_vault/gcp/secret_roleset.py +554 -0
- pulumi_vault/gcp/secret_static_account.py +557 -0
- pulumi_vault/generic/__init__.py +11 -0
- pulumi_vault/generic/endpoint.py +786 -0
- pulumi_vault/generic/get_secret.py +306 -0
- pulumi_vault/generic/secret.py +486 -0
- pulumi_vault/get_auth_backend.py +226 -0
- pulumi_vault/get_auth_backends.py +170 -0
- pulumi_vault/get_namespace.py +226 -0
- pulumi_vault/get_namespaces.py +202 -0
- pulumi_vault/get_nomad_access_token.py +210 -0
- pulumi_vault/get_policy_document.py +160 -0
- pulumi_vault/get_raft_autopilot_state.py +267 -0
- pulumi_vault/github/__init__.py +13 -0
- pulumi_vault/github/_inputs.py +225 -0
- pulumi_vault/github/auth_backend.py +1194 -0
- pulumi_vault/github/outputs.py +174 -0
- pulumi_vault/github/team.py +380 -0
- pulumi_vault/github/user.py +380 -0
- pulumi_vault/identity/__init__.py +35 -0
- pulumi_vault/identity/entity.py +447 -0
- pulumi_vault/identity/entity_alias.py +398 -0
- pulumi_vault/identity/entity_policies.py +455 -0
- pulumi_vault/identity/get_entity.py +384 -0
- pulumi_vault/identity/get_group.py +467 -0
- pulumi_vault/identity/get_oidc_client_creds.py +175 -0
- pulumi_vault/identity/get_oidc_openid_config.py +334 -0
- pulumi_vault/identity/get_oidc_public_keys.py +179 -0
- pulumi_vault/identity/group.py +805 -0
- pulumi_vault/identity/group_alias.py +386 -0
- pulumi_vault/identity/group_member_entity_ids.py +444 -0
- pulumi_vault/identity/group_member_group_ids.py +467 -0
- pulumi_vault/identity/group_policies.py +471 -0
- pulumi_vault/identity/mfa_duo.py +674 -0
- pulumi_vault/identity/mfa_login_enforcement.py +566 -0
- pulumi_vault/identity/mfa_okta.py +626 -0
- pulumi_vault/identity/mfa_pingid.py +616 -0
- pulumi_vault/identity/mfa_totp.py +758 -0
- pulumi_vault/identity/oidc.py +268 -0
- pulumi_vault/identity/oidc_assignment.py +375 -0
- pulumi_vault/identity/oidc_client.py +667 -0
- pulumi_vault/identity/oidc_key.py +474 -0
- pulumi_vault/identity/oidc_key_allowed_client_id.py +298 -0
- pulumi_vault/identity/oidc_provider.py +550 -0
- pulumi_vault/identity/oidc_role.py +543 -0
- pulumi_vault/identity/oidc_scope.py +355 -0
- pulumi_vault/identity/outputs.py +137 -0
- pulumi_vault/jwt/__init__.py +12 -0
- pulumi_vault/jwt/_inputs.py +225 -0
- pulumi_vault/jwt/auth_backend.py +1347 -0
- pulumi_vault/jwt/auth_backend_role.py +1847 -0
- pulumi_vault/jwt/outputs.py +174 -0
- pulumi_vault/kmip/__init__.py +11 -0
- pulumi_vault/kmip/secret_backend.py +1591 -0
- pulumi_vault/kmip/secret_role.py +1194 -0
- pulumi_vault/kmip/secret_scope.py +372 -0
- pulumi_vault/kubernetes/__init__.py +15 -0
- pulumi_vault/kubernetes/auth_backend_config.py +654 -0
- pulumi_vault/kubernetes/auth_backend_role.py +1031 -0
- pulumi_vault/kubernetes/get_auth_backend_config.py +280 -0
- pulumi_vault/kubernetes/get_auth_backend_role.py +470 -0
- pulumi_vault/kubernetes/get_service_account_token.py +344 -0
- pulumi_vault/kubernetes/secret_backend.py +1341 -0
- pulumi_vault/kubernetes/secret_backend_role.py +1140 -0
- pulumi_vault/kv/__init__.py +18 -0
- pulumi_vault/kv/_inputs.py +124 -0
- pulumi_vault/kv/get_secret.py +240 -0
- pulumi_vault/kv/get_secret_subkeys_v2.py +275 -0
- pulumi_vault/kv/get_secret_v2.py +315 -0
- pulumi_vault/kv/get_secrets_list.py +186 -0
- pulumi_vault/kv/get_secrets_list_v2.py +243 -0
- pulumi_vault/kv/outputs.py +102 -0
- pulumi_vault/kv/secret.py +397 -0
- pulumi_vault/kv/secret_backend_v2.py +455 -0
- pulumi_vault/kv/secret_v2.py +970 -0
- pulumi_vault/ldap/__init__.py +19 -0
- pulumi_vault/ldap/_inputs.py +225 -0
- pulumi_vault/ldap/auth_backend.py +2520 -0
- pulumi_vault/ldap/auth_backend_group.py +386 -0
- pulumi_vault/ldap/auth_backend_user.py +439 -0
- pulumi_vault/ldap/get_dynamic_credentials.py +181 -0
- pulumi_vault/ldap/get_static_credentials.py +192 -0
- pulumi_vault/ldap/outputs.py +174 -0
- pulumi_vault/ldap/secret_backend.py +2207 -0
- pulumi_vault/ldap/secret_backend_dynamic_role.py +767 -0
- pulumi_vault/ldap/secret_backend_library_set.py +552 -0
- pulumi_vault/ldap/secret_backend_static_role.py +541 -0
- pulumi_vault/managed/__init__.py +11 -0
- pulumi_vault/managed/_inputs.py +944 -0
- pulumi_vault/managed/keys.py +398 -0
- pulumi_vault/managed/outputs.py +667 -0
- pulumi_vault/mfa_duo.py +589 -0
- pulumi_vault/mfa_okta.py +623 -0
- pulumi_vault/mfa_pingid.py +670 -0
- pulumi_vault/mfa_totp.py +620 -0
- pulumi_vault/mongodbatlas/__init__.py +10 -0
- pulumi_vault/mongodbatlas/secret_backend.py +388 -0
- pulumi_vault/mongodbatlas/secret_role.py +726 -0
- pulumi_vault/mount.py +1262 -0
- pulumi_vault/namespace.py +452 -0
- pulumi_vault/nomad_secret_backend.py +1559 -0
- pulumi_vault/nomad_secret_role.py +489 -0
- pulumi_vault/oci_auth_backend.py +676 -0
- pulumi_vault/oci_auth_backend_role.py +852 -0
- pulumi_vault/okta/__init__.py +13 -0
- pulumi_vault/okta/_inputs.py +320 -0
- pulumi_vault/okta/auth_backend.py +1231 -0
- pulumi_vault/okta/auth_backend_group.py +369 -0
- pulumi_vault/okta/auth_backend_user.py +416 -0
- pulumi_vault/okta/outputs.py +244 -0
- pulumi_vault/outputs.py +502 -0
- pulumi_vault/pkisecret/__init__.py +38 -0
- pulumi_vault/pkisecret/_inputs.py +270 -0
- pulumi_vault/pkisecret/backend_acme_eab.py +550 -0
- pulumi_vault/pkisecret/backend_config_acme.py +690 -0
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +1370 -0
- pulumi_vault/pkisecret/backend_config_cluster.py +370 -0
- pulumi_vault/pkisecret/backend_config_cmpv2.py +693 -0
- pulumi_vault/pkisecret/backend_config_est.py +756 -0
- pulumi_vault/pkisecret/backend_config_scep.py +738 -0
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +277 -0
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +226 -0
- pulumi_vault/pkisecret/get_backend_config_est.py +251 -0
- pulumi_vault/pkisecret/get_backend_config_scep.py +271 -0
- pulumi_vault/pkisecret/get_backend_issuer.py +395 -0
- pulumi_vault/pkisecret/get_backend_issuers.py +192 -0
- pulumi_vault/pkisecret/get_backend_key.py +211 -0
- pulumi_vault/pkisecret/get_backend_keys.py +192 -0
- pulumi_vault/pkisecret/outputs.py +270 -0
- pulumi_vault/pkisecret/secret_backend_cert.py +1315 -0
- pulumi_vault/pkisecret/secret_backend_config_ca.py +386 -0
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +392 -0
- pulumi_vault/pkisecret/secret_backend_config_urls.py +462 -0
- pulumi_vault/pkisecret/secret_backend_crl_config.py +846 -0
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +1629 -0
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +444 -0
- pulumi_vault/pkisecret/secret_backend_issuer.py +1089 -0
- pulumi_vault/pkisecret/secret_backend_key.py +613 -0
- pulumi_vault/pkisecret/secret_backend_role.py +2694 -0
- pulumi_vault/pkisecret/secret_backend_root_cert.py +2134 -0
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +2031 -0
- pulumi_vault/pkisecret/secret_backend_sign.py +1194 -0
- pulumi_vault/plugin.py +596 -0
- pulumi_vault/plugin_pinned_version.py +299 -0
- pulumi_vault/policy.py +279 -0
- pulumi_vault/provider.py +781 -0
- pulumi_vault/pulumi-plugin.json +5 -0
- pulumi_vault/py.typed +0 -0
- pulumi_vault/quota_lease_count.py +504 -0
- pulumi_vault/quota_rate_limit.py +751 -0
- pulumi_vault/rabbitmq/__init__.py +12 -0
- pulumi_vault/rabbitmq/_inputs.py +235 -0
- pulumi_vault/rabbitmq/outputs.py +144 -0
- pulumi_vault/rabbitmq/secret_backend.py +1437 -0
- pulumi_vault/rabbitmq/secret_backend_role.py +496 -0
- pulumi_vault/raft_autopilot.py +609 -0
- pulumi_vault/raft_snapshot_agent_config.py +1591 -0
- pulumi_vault/rgp_policy.py +349 -0
- pulumi_vault/saml/__init__.py +12 -0
- pulumi_vault/saml/_inputs.py +225 -0
- pulumi_vault/saml/auth_backend.py +811 -0
- pulumi_vault/saml/auth_backend_role.py +1068 -0
- pulumi_vault/saml/outputs.py +174 -0
- pulumi_vault/scep_auth_backend_role.py +908 -0
- pulumi_vault/secrets/__init__.py +18 -0
- pulumi_vault/secrets/_inputs.py +110 -0
- pulumi_vault/secrets/outputs.py +94 -0
- pulumi_vault/secrets/sync_association.py +450 -0
- pulumi_vault/secrets/sync_aws_destination.py +780 -0
- pulumi_vault/secrets/sync_azure_destination.py +736 -0
- pulumi_vault/secrets/sync_config.py +303 -0
- pulumi_vault/secrets/sync_gcp_destination.py +572 -0
- pulumi_vault/secrets/sync_gh_destination.py +688 -0
- pulumi_vault/secrets/sync_github_apps.py +376 -0
- pulumi_vault/secrets/sync_vercel_destination.py +603 -0
- pulumi_vault/ssh/__init__.py +13 -0
- pulumi_vault/ssh/_inputs.py +76 -0
- pulumi_vault/ssh/get_secret_backend_sign.py +294 -0
- pulumi_vault/ssh/outputs.py +51 -0
- pulumi_vault/ssh/secret_backend_ca.py +588 -0
- pulumi_vault/ssh/secret_backend_role.py +1493 -0
- pulumi_vault/terraformcloud/__init__.py +11 -0
- pulumi_vault/terraformcloud/secret_backend.py +1321 -0
- pulumi_vault/terraformcloud/secret_creds.py +445 -0
- pulumi_vault/terraformcloud/secret_role.py +563 -0
- pulumi_vault/token.py +1026 -0
- pulumi_vault/tokenauth/__init__.py +9 -0
- pulumi_vault/tokenauth/auth_backend_role.py +1135 -0
- pulumi_vault/transform/__init__.py +14 -0
- pulumi_vault/transform/alphabet.py +348 -0
- pulumi_vault/transform/get_decode.py +287 -0
- pulumi_vault/transform/get_encode.py +291 -0
- pulumi_vault/transform/role.py +350 -0
- pulumi_vault/transform/template.py +592 -0
- pulumi_vault/transform/transformation.py +608 -0
- pulumi_vault/transit/__init__.py +15 -0
- pulumi_vault/transit/get_cmac.py +256 -0
- pulumi_vault/transit/get_decrypt.py +181 -0
- pulumi_vault/transit/get_encrypt.py +174 -0
- pulumi_vault/transit/get_sign.py +328 -0
- pulumi_vault/transit/get_verify.py +373 -0
- pulumi_vault/transit/secret_backend_key.py +1202 -0
- pulumi_vault/transit/secret_cache_config.py +302 -0
- pulumi_vault-7.6.0a1764657486.dist-info/METADATA +92 -0
- pulumi_vault-7.6.0a1764657486.dist-info/RECORD +274 -0
- pulumi_vault-7.6.0a1764657486.dist-info/WHEEL +5 -0
- pulumi_vault-7.6.0a1764657486.dist-info/top_level.txt +1 -0
|
@@ -0,0 +1,2207 @@
|
|
|
1
|
+
# coding=utf-8
|
|
2
|
+
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
|
+
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
|
+
|
|
5
|
+
import builtins as _builtins
|
|
6
|
+
import warnings
|
|
7
|
+
import sys
|
|
8
|
+
import pulumi
|
|
9
|
+
import pulumi.runtime
|
|
10
|
+
from typing import Any, Mapping, Optional, Sequence, Union, overload
|
|
11
|
+
if sys.version_info >= (3, 11):
|
|
12
|
+
from typing import NotRequired, TypedDict, TypeAlias
|
|
13
|
+
else:
|
|
14
|
+
from typing_extensions import NotRequired, TypedDict, TypeAlias
|
|
15
|
+
from .. import _utilities
|
|
16
|
+
|
|
17
|
+
__all__ = ['SecretBackendArgs', 'SecretBackend']
|
|
18
|
+
|
|
19
|
+
@pulumi.input_type
|
|
20
|
+
class SecretBackendArgs:
|
|
21
|
+
def __init__(__self__, *,
|
|
22
|
+
binddn: pulumi.Input[_builtins.str],
|
|
23
|
+
bindpass: pulumi.Input[_builtins.str],
|
|
24
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
25
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
26
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
27
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
28
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
29
|
+
client_tls_cert: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
|
+
client_tls_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
|
+
connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
32
|
+
credential_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
33
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
34
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
35
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
36
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
37
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
38
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
39
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
40
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
41
|
+
insecure_tls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
42
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
43
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
44
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
45
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
46
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
47
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
48
|
+
password_policy: Optional[pulumi.Input[_builtins.str]] = None,
|
|
49
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
50
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
51
|
+
request_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
52
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
53
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
54
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
55
|
+
schema: Optional[pulumi.Input[_builtins.str]] = None,
|
|
56
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
57
|
+
skip_static_role_import_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
58
|
+
starttls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
59
|
+
upndomain: Optional[pulumi.Input[_builtins.str]] = None,
|
|
60
|
+
url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
61
|
+
userattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
62
|
+
userdn: Optional[pulumi.Input[_builtins.str]] = None):
|
|
63
|
+
"""
|
|
64
|
+
The set of arguments for constructing a SecretBackend resource.
|
|
65
|
+
:param pulumi.Input[_builtins.str] binddn: Distinguished name of object to bind when performing user and group search.
|
|
66
|
+
:param pulumi.Input[_builtins.str] bindpass: Password to use along with binddn when performing user search.
|
|
67
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
68
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
69
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
70
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
71
|
+
:param pulumi.Input[_builtins.str] certificate: CA certificate to use when verifying LDAP server certificate, must be
|
|
72
|
+
x509 PEM encoded.
|
|
73
|
+
:param pulumi.Input[_builtins.str] client_tls_cert: Client certificate to provide to the LDAP server, must be x509 PEM encoded.
|
|
74
|
+
:param pulumi.Input[_builtins.str] client_tls_key: Client certificate key to provide to the LDAP server, must be x509 PEM encoded.
|
|
75
|
+
:param pulumi.Input[_builtins.int] connection_timeout: Timeout, in seconds, when attempting to connect to the LDAP server before trying
|
|
76
|
+
the next URL in the configuration.
|
|
77
|
+
:param pulumi.Input[_builtins.str] credential_type: The type of credential to generate. Valid values include `password` and `phrase`. Default is `password`.
|
|
78
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
|
|
79
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
80
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount
|
|
81
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
82
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
83
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
84
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
85
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
|
|
86
|
+
:param pulumi.Input[_builtins.bool] insecure_tls: Skip LDAP server SSL Certificate verification. This is not recommended for production.
|
|
87
|
+
Defaults to `false`.
|
|
88
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
89
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
90
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
|
|
91
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
92
|
+
The value should not contain leading or trailing forward slashes.
|
|
93
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
94
|
+
*Available only for Vault Enterprise*.
|
|
95
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
96
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
97
|
+
:param pulumi.Input[_builtins.str] password_policy: Name of the password policy to use to generate passwords.
|
|
98
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
99
|
+
not begin or end with a `/`. Defaults to `ldap`.
|
|
100
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
101
|
+
:param pulumi.Input[_builtins.int] request_timeout: Timeout, in seconds, for the connection when making requests against the server
|
|
102
|
+
before returning back an error.
|
|
103
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
104
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
105
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
106
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
107
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
108
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
109
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
110
|
+
:param pulumi.Input[_builtins.str] schema: The LDAP schema to use when storing entry passwords. Valid schemas include `openldap`, `ad`, and `racf`. Default is `openldap`.
|
|
111
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
112
|
+
:param pulumi.Input[_builtins.bool] skip_static_role_import_rotation: If set to true, static roles will not be rotated during import.
|
|
113
|
+
Defaults to false. Requires Vault 1.16 or above.
|
|
114
|
+
:param pulumi.Input[_builtins.bool] starttls: Issue a StartTLS command after establishing unencrypted connection.
|
|
115
|
+
:param pulumi.Input[_builtins.str] upndomain: Enables userPrincipalDomain login with [username]@UPNDomain.
|
|
116
|
+
:param pulumi.Input[_builtins.str] url: LDAP URL to connect to. Multiple URLs can be specified by concatenating
|
|
117
|
+
them with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.
|
|
118
|
+
:param pulumi.Input[_builtins.str] userattr: Attribute used when searching users. Defaults to `cn`.
|
|
119
|
+
:param pulumi.Input[_builtins.str] userdn: LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.
|
|
120
|
+
"""
|
|
121
|
+
pulumi.set(__self__, "binddn", binddn)
|
|
122
|
+
pulumi.set(__self__, "bindpass", bindpass)
|
|
123
|
+
if allowed_managed_keys is not None:
|
|
124
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
125
|
+
if allowed_response_headers is not None:
|
|
126
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
127
|
+
if audit_non_hmac_request_keys is not None:
|
|
128
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
129
|
+
if audit_non_hmac_response_keys is not None:
|
|
130
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
131
|
+
if certificate is not None:
|
|
132
|
+
pulumi.set(__self__, "certificate", certificate)
|
|
133
|
+
if client_tls_cert is not None:
|
|
134
|
+
pulumi.set(__self__, "client_tls_cert", client_tls_cert)
|
|
135
|
+
if client_tls_key is not None:
|
|
136
|
+
pulumi.set(__self__, "client_tls_key", client_tls_key)
|
|
137
|
+
if connection_timeout is not None:
|
|
138
|
+
pulumi.set(__self__, "connection_timeout", connection_timeout)
|
|
139
|
+
if credential_type is not None:
|
|
140
|
+
pulumi.set(__self__, "credential_type", credential_type)
|
|
141
|
+
if default_lease_ttl_seconds is not None:
|
|
142
|
+
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
143
|
+
if delegated_auth_accessors is not None:
|
|
144
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
145
|
+
if description is not None:
|
|
146
|
+
pulumi.set(__self__, "description", description)
|
|
147
|
+
if disable_automated_rotation is not None:
|
|
148
|
+
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
149
|
+
if disable_remount is not None:
|
|
150
|
+
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
151
|
+
if external_entropy_access is not None:
|
|
152
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
153
|
+
if force_no_cache is not None:
|
|
154
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
155
|
+
if identity_token_key is not None:
|
|
156
|
+
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
157
|
+
if insecure_tls is not None:
|
|
158
|
+
pulumi.set(__self__, "insecure_tls", insecure_tls)
|
|
159
|
+
if listing_visibility is not None:
|
|
160
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
161
|
+
if local is not None:
|
|
162
|
+
pulumi.set(__self__, "local", local)
|
|
163
|
+
if max_lease_ttl_seconds is not None:
|
|
164
|
+
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
165
|
+
if namespace is not None:
|
|
166
|
+
pulumi.set(__self__, "namespace", namespace)
|
|
167
|
+
if options is not None:
|
|
168
|
+
pulumi.set(__self__, "options", options)
|
|
169
|
+
if passthrough_request_headers is not None:
|
|
170
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
171
|
+
if password_policy is not None:
|
|
172
|
+
pulumi.set(__self__, "password_policy", password_policy)
|
|
173
|
+
if path is not None:
|
|
174
|
+
pulumi.set(__self__, "path", path)
|
|
175
|
+
if plugin_version is not None:
|
|
176
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
177
|
+
if request_timeout is not None:
|
|
178
|
+
pulumi.set(__self__, "request_timeout", request_timeout)
|
|
179
|
+
if rotation_period is not None:
|
|
180
|
+
pulumi.set(__self__, "rotation_period", rotation_period)
|
|
181
|
+
if rotation_schedule is not None:
|
|
182
|
+
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
183
|
+
if rotation_window is not None:
|
|
184
|
+
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
185
|
+
if schema is not None:
|
|
186
|
+
pulumi.set(__self__, "schema", schema)
|
|
187
|
+
if seal_wrap is not None:
|
|
188
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
189
|
+
if skip_static_role_import_rotation is not None:
|
|
190
|
+
pulumi.set(__self__, "skip_static_role_import_rotation", skip_static_role_import_rotation)
|
|
191
|
+
if starttls is not None:
|
|
192
|
+
pulumi.set(__self__, "starttls", starttls)
|
|
193
|
+
if upndomain is not None:
|
|
194
|
+
pulumi.set(__self__, "upndomain", upndomain)
|
|
195
|
+
if url is not None:
|
|
196
|
+
pulumi.set(__self__, "url", url)
|
|
197
|
+
if userattr is not None:
|
|
198
|
+
pulumi.set(__self__, "userattr", userattr)
|
|
199
|
+
if userdn is not None:
|
|
200
|
+
pulumi.set(__self__, "userdn", userdn)
|
|
201
|
+
|
|
202
|
+
@_builtins.property
|
|
203
|
+
@pulumi.getter
|
|
204
|
+
def binddn(self) -> pulumi.Input[_builtins.str]:
|
|
205
|
+
"""
|
|
206
|
+
Distinguished name of object to bind when performing user and group search.
|
|
207
|
+
"""
|
|
208
|
+
return pulumi.get(self, "binddn")
|
|
209
|
+
|
|
210
|
+
@binddn.setter
|
|
211
|
+
def binddn(self, value: pulumi.Input[_builtins.str]):
|
|
212
|
+
pulumi.set(self, "binddn", value)
|
|
213
|
+
|
|
214
|
+
@_builtins.property
|
|
215
|
+
@pulumi.getter
|
|
216
|
+
def bindpass(self) -> pulumi.Input[_builtins.str]:
|
|
217
|
+
"""
|
|
218
|
+
Password to use along with binddn when performing user search.
|
|
219
|
+
"""
|
|
220
|
+
return pulumi.get(self, "bindpass")
|
|
221
|
+
|
|
222
|
+
@bindpass.setter
|
|
223
|
+
def bindpass(self, value: pulumi.Input[_builtins.str]):
|
|
224
|
+
pulumi.set(self, "bindpass", value)
|
|
225
|
+
|
|
226
|
+
@_builtins.property
|
|
227
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
228
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
229
|
+
"""
|
|
230
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
231
|
+
"""
|
|
232
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
233
|
+
|
|
234
|
+
@allowed_managed_keys.setter
|
|
235
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
236
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
237
|
+
|
|
238
|
+
@_builtins.property
|
|
239
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
240
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
241
|
+
"""
|
|
242
|
+
List of headers to allow and pass from the request to the plugin
|
|
243
|
+
"""
|
|
244
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
245
|
+
|
|
246
|
+
@allowed_response_headers.setter
|
|
247
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
248
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
249
|
+
|
|
250
|
+
@_builtins.property
|
|
251
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
252
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
253
|
+
"""
|
|
254
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
255
|
+
"""
|
|
256
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
257
|
+
|
|
258
|
+
@audit_non_hmac_request_keys.setter
|
|
259
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
260
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
261
|
+
|
|
262
|
+
@_builtins.property
|
|
263
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
264
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
265
|
+
"""
|
|
266
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
267
|
+
"""
|
|
268
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
269
|
+
|
|
270
|
+
@audit_non_hmac_response_keys.setter
|
|
271
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
272
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
273
|
+
|
|
274
|
+
@_builtins.property
|
|
275
|
+
@pulumi.getter
|
|
276
|
+
def certificate(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
277
|
+
"""
|
|
278
|
+
CA certificate to use when verifying LDAP server certificate, must be
|
|
279
|
+
x509 PEM encoded.
|
|
280
|
+
"""
|
|
281
|
+
return pulumi.get(self, "certificate")
|
|
282
|
+
|
|
283
|
+
@certificate.setter
|
|
284
|
+
def certificate(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
285
|
+
pulumi.set(self, "certificate", value)
|
|
286
|
+
|
|
287
|
+
@_builtins.property
|
|
288
|
+
@pulumi.getter(name="clientTlsCert")
|
|
289
|
+
def client_tls_cert(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
290
|
+
"""
|
|
291
|
+
Client certificate to provide to the LDAP server, must be x509 PEM encoded.
|
|
292
|
+
"""
|
|
293
|
+
return pulumi.get(self, "client_tls_cert")
|
|
294
|
+
|
|
295
|
+
@client_tls_cert.setter
|
|
296
|
+
def client_tls_cert(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
297
|
+
pulumi.set(self, "client_tls_cert", value)
|
|
298
|
+
|
|
299
|
+
@_builtins.property
|
|
300
|
+
@pulumi.getter(name="clientTlsKey")
|
|
301
|
+
def client_tls_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
302
|
+
"""
|
|
303
|
+
Client certificate key to provide to the LDAP server, must be x509 PEM encoded.
|
|
304
|
+
"""
|
|
305
|
+
return pulumi.get(self, "client_tls_key")
|
|
306
|
+
|
|
307
|
+
@client_tls_key.setter
|
|
308
|
+
def client_tls_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
309
|
+
pulumi.set(self, "client_tls_key", value)
|
|
310
|
+
|
|
311
|
+
@_builtins.property
|
|
312
|
+
@pulumi.getter(name="connectionTimeout")
|
|
313
|
+
def connection_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
314
|
+
"""
|
|
315
|
+
Timeout, in seconds, when attempting to connect to the LDAP server before trying
|
|
316
|
+
the next URL in the configuration.
|
|
317
|
+
"""
|
|
318
|
+
return pulumi.get(self, "connection_timeout")
|
|
319
|
+
|
|
320
|
+
@connection_timeout.setter
|
|
321
|
+
def connection_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
322
|
+
pulumi.set(self, "connection_timeout", value)
|
|
323
|
+
|
|
324
|
+
@_builtins.property
|
|
325
|
+
@pulumi.getter(name="credentialType")
|
|
326
|
+
def credential_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
327
|
+
"""
|
|
328
|
+
The type of credential to generate. Valid values include `password` and `phrase`. Default is `password`.
|
|
329
|
+
"""
|
|
330
|
+
return pulumi.get(self, "credential_type")
|
|
331
|
+
|
|
332
|
+
@credential_type.setter
|
|
333
|
+
def credential_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
334
|
+
pulumi.set(self, "credential_type", value)
|
|
335
|
+
|
|
336
|
+
@_builtins.property
|
|
337
|
+
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
338
|
+
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
339
|
+
"""
|
|
340
|
+
Default lease duration for tokens and secrets in seconds
|
|
341
|
+
"""
|
|
342
|
+
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
343
|
+
|
|
344
|
+
@default_lease_ttl_seconds.setter
|
|
345
|
+
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
346
|
+
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
347
|
+
|
|
348
|
+
@_builtins.property
|
|
349
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
350
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
351
|
+
"""
|
|
352
|
+
List of headers to allow and pass from the request to the plugin
|
|
353
|
+
"""
|
|
354
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
355
|
+
|
|
356
|
+
@delegated_auth_accessors.setter
|
|
357
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
358
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
359
|
+
|
|
360
|
+
@_builtins.property
|
|
361
|
+
@pulumi.getter
|
|
362
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
363
|
+
"""
|
|
364
|
+
Human-friendly description of the mount
|
|
365
|
+
"""
|
|
366
|
+
return pulumi.get(self, "description")
|
|
367
|
+
|
|
368
|
+
@description.setter
|
|
369
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
370
|
+
pulumi.set(self, "description", value)
|
|
371
|
+
|
|
372
|
+
@_builtins.property
|
|
373
|
+
@pulumi.getter(name="disableAutomatedRotation")
|
|
374
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
375
|
+
"""
|
|
376
|
+
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
377
|
+
"""
|
|
378
|
+
return pulumi.get(self, "disable_automated_rotation")
|
|
379
|
+
|
|
380
|
+
@disable_automated_rotation.setter
|
|
381
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
382
|
+
pulumi.set(self, "disable_automated_rotation", value)
|
|
383
|
+
|
|
384
|
+
@_builtins.property
|
|
385
|
+
@pulumi.getter(name="disableRemount")
|
|
386
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
387
|
+
"""
|
|
388
|
+
If set, opts out of mount migration on path updates.
|
|
389
|
+
"""
|
|
390
|
+
return pulumi.get(self, "disable_remount")
|
|
391
|
+
|
|
392
|
+
@disable_remount.setter
|
|
393
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
394
|
+
pulumi.set(self, "disable_remount", value)
|
|
395
|
+
|
|
396
|
+
@_builtins.property
|
|
397
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
398
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
399
|
+
"""
|
|
400
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
401
|
+
"""
|
|
402
|
+
return pulumi.get(self, "external_entropy_access")
|
|
403
|
+
|
|
404
|
+
@external_entropy_access.setter
|
|
405
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
406
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
407
|
+
|
|
408
|
+
@_builtins.property
|
|
409
|
+
@pulumi.getter(name="forceNoCache")
|
|
410
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
411
|
+
"""
|
|
412
|
+
If set to true, disables caching.
|
|
413
|
+
"""
|
|
414
|
+
return pulumi.get(self, "force_no_cache")
|
|
415
|
+
|
|
416
|
+
@force_no_cache.setter
|
|
417
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
418
|
+
pulumi.set(self, "force_no_cache", value)
|
|
419
|
+
|
|
420
|
+
@_builtins.property
|
|
421
|
+
@pulumi.getter(name="identityTokenKey")
|
|
422
|
+
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
423
|
+
"""
|
|
424
|
+
The key to use for signing plugin workload identity tokens
|
|
425
|
+
"""
|
|
426
|
+
return pulumi.get(self, "identity_token_key")
|
|
427
|
+
|
|
428
|
+
@identity_token_key.setter
|
|
429
|
+
def identity_token_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
430
|
+
pulumi.set(self, "identity_token_key", value)
|
|
431
|
+
|
|
432
|
+
@_builtins.property
|
|
433
|
+
@pulumi.getter(name="insecureTls")
|
|
434
|
+
def insecure_tls(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
435
|
+
"""
|
|
436
|
+
Skip LDAP server SSL Certificate verification. This is not recommended for production.
|
|
437
|
+
Defaults to `false`.
|
|
438
|
+
"""
|
|
439
|
+
return pulumi.get(self, "insecure_tls")
|
|
440
|
+
|
|
441
|
+
@insecure_tls.setter
|
|
442
|
+
def insecure_tls(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
443
|
+
pulumi.set(self, "insecure_tls", value)
|
|
444
|
+
|
|
445
|
+
@_builtins.property
|
|
446
|
+
@pulumi.getter(name="listingVisibility")
|
|
447
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
448
|
+
"""
|
|
449
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
450
|
+
"""
|
|
451
|
+
return pulumi.get(self, "listing_visibility")
|
|
452
|
+
|
|
453
|
+
@listing_visibility.setter
|
|
454
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
455
|
+
pulumi.set(self, "listing_visibility", value)
|
|
456
|
+
|
|
457
|
+
@_builtins.property
|
|
458
|
+
@pulumi.getter
|
|
459
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
460
|
+
"""
|
|
461
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
462
|
+
"""
|
|
463
|
+
return pulumi.get(self, "local")
|
|
464
|
+
|
|
465
|
+
@local.setter
|
|
466
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
467
|
+
pulumi.set(self, "local", value)
|
|
468
|
+
|
|
469
|
+
@_builtins.property
|
|
470
|
+
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
471
|
+
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
472
|
+
"""
|
|
473
|
+
Maximum possible lease duration for tokens and secrets in seconds
|
|
474
|
+
"""
|
|
475
|
+
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
476
|
+
|
|
477
|
+
@max_lease_ttl_seconds.setter
|
|
478
|
+
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
479
|
+
pulumi.set(self, "max_lease_ttl_seconds", value)
|
|
480
|
+
|
|
481
|
+
@_builtins.property
|
|
482
|
+
@pulumi.getter
|
|
483
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
484
|
+
"""
|
|
485
|
+
The namespace to provision the resource in.
|
|
486
|
+
The value should not contain leading or trailing forward slashes.
|
|
487
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
488
|
+
*Available only for Vault Enterprise*.
|
|
489
|
+
"""
|
|
490
|
+
return pulumi.get(self, "namespace")
|
|
491
|
+
|
|
492
|
+
@namespace.setter
|
|
493
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
494
|
+
pulumi.set(self, "namespace", value)
|
|
495
|
+
|
|
496
|
+
@_builtins.property
|
|
497
|
+
@pulumi.getter
|
|
498
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
499
|
+
"""
|
|
500
|
+
Specifies mount type specific options that are passed to the backend
|
|
501
|
+
"""
|
|
502
|
+
return pulumi.get(self, "options")
|
|
503
|
+
|
|
504
|
+
@options.setter
|
|
505
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
506
|
+
pulumi.set(self, "options", value)
|
|
507
|
+
|
|
508
|
+
@_builtins.property
|
|
509
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
510
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
511
|
+
"""
|
|
512
|
+
List of headers to allow and pass from the request to the plugin
|
|
513
|
+
"""
|
|
514
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
515
|
+
|
|
516
|
+
@passthrough_request_headers.setter
|
|
517
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
518
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
519
|
+
|
|
520
|
+
@_builtins.property
|
|
521
|
+
@pulumi.getter(name="passwordPolicy")
|
|
522
|
+
def password_policy(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
523
|
+
"""
|
|
524
|
+
Name of the password policy to use to generate passwords.
|
|
525
|
+
"""
|
|
526
|
+
return pulumi.get(self, "password_policy")
|
|
527
|
+
|
|
528
|
+
@password_policy.setter
|
|
529
|
+
def password_policy(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
530
|
+
pulumi.set(self, "password_policy", value)
|
|
531
|
+
|
|
532
|
+
@_builtins.property
|
|
533
|
+
@pulumi.getter
|
|
534
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
535
|
+
"""
|
|
536
|
+
The unique path this backend should be mounted at. Must
|
|
537
|
+
not begin or end with a `/`. Defaults to `ldap`.
|
|
538
|
+
"""
|
|
539
|
+
return pulumi.get(self, "path")
|
|
540
|
+
|
|
541
|
+
@path.setter
|
|
542
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
543
|
+
pulumi.set(self, "path", value)
|
|
544
|
+
|
|
545
|
+
@_builtins.property
|
|
546
|
+
@pulumi.getter(name="pluginVersion")
|
|
547
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
548
|
+
"""
|
|
549
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
550
|
+
"""
|
|
551
|
+
return pulumi.get(self, "plugin_version")
|
|
552
|
+
|
|
553
|
+
@plugin_version.setter
|
|
554
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
555
|
+
pulumi.set(self, "plugin_version", value)
|
|
556
|
+
|
|
557
|
+
@_builtins.property
|
|
558
|
+
@pulumi.getter(name="requestTimeout")
|
|
559
|
+
def request_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
560
|
+
"""
|
|
561
|
+
Timeout, in seconds, for the connection when making requests against the server
|
|
562
|
+
before returning back an error.
|
|
563
|
+
"""
|
|
564
|
+
return pulumi.get(self, "request_timeout")
|
|
565
|
+
|
|
566
|
+
@request_timeout.setter
|
|
567
|
+
def request_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
568
|
+
pulumi.set(self, "request_timeout", value)
|
|
569
|
+
|
|
570
|
+
@_builtins.property
|
|
571
|
+
@pulumi.getter(name="rotationPeriod")
|
|
572
|
+
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
573
|
+
"""
|
|
574
|
+
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
575
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
576
|
+
"""
|
|
577
|
+
return pulumi.get(self, "rotation_period")
|
|
578
|
+
|
|
579
|
+
@rotation_period.setter
|
|
580
|
+
def rotation_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
581
|
+
pulumi.set(self, "rotation_period", value)
|
|
582
|
+
|
|
583
|
+
@_builtins.property
|
|
584
|
+
@pulumi.getter(name="rotationSchedule")
|
|
585
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
586
|
+
"""
|
|
587
|
+
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
588
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
589
|
+
"""
|
|
590
|
+
return pulumi.get(self, "rotation_schedule")
|
|
591
|
+
|
|
592
|
+
@rotation_schedule.setter
|
|
593
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
594
|
+
pulumi.set(self, "rotation_schedule", value)
|
|
595
|
+
|
|
596
|
+
@_builtins.property
|
|
597
|
+
@pulumi.getter(name="rotationWindow")
|
|
598
|
+
def rotation_window(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
599
|
+
"""
|
|
600
|
+
The maximum amount of time in seconds allowed to complete
|
|
601
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
602
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
603
|
+
"""
|
|
604
|
+
return pulumi.get(self, "rotation_window")
|
|
605
|
+
|
|
606
|
+
@rotation_window.setter
|
|
607
|
+
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
608
|
+
pulumi.set(self, "rotation_window", value)
|
|
609
|
+
|
|
610
|
+
@_builtins.property
|
|
611
|
+
@pulumi.getter
|
|
612
|
+
def schema(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
613
|
+
"""
|
|
614
|
+
The LDAP schema to use when storing entry passwords. Valid schemas include `openldap`, `ad`, and `racf`. Default is `openldap`.
|
|
615
|
+
"""
|
|
616
|
+
return pulumi.get(self, "schema")
|
|
617
|
+
|
|
618
|
+
@schema.setter
|
|
619
|
+
def schema(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
620
|
+
pulumi.set(self, "schema", value)
|
|
621
|
+
|
|
622
|
+
@_builtins.property
|
|
623
|
+
@pulumi.getter(name="sealWrap")
|
|
624
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
625
|
+
"""
|
|
626
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
627
|
+
"""
|
|
628
|
+
return pulumi.get(self, "seal_wrap")
|
|
629
|
+
|
|
630
|
+
@seal_wrap.setter
|
|
631
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
632
|
+
pulumi.set(self, "seal_wrap", value)
|
|
633
|
+
|
|
634
|
+
@_builtins.property
|
|
635
|
+
@pulumi.getter(name="skipStaticRoleImportRotation")
|
|
636
|
+
def skip_static_role_import_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
637
|
+
"""
|
|
638
|
+
If set to true, static roles will not be rotated during import.
|
|
639
|
+
Defaults to false. Requires Vault 1.16 or above.
|
|
640
|
+
"""
|
|
641
|
+
return pulumi.get(self, "skip_static_role_import_rotation")
|
|
642
|
+
|
|
643
|
+
@skip_static_role_import_rotation.setter
|
|
644
|
+
def skip_static_role_import_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
645
|
+
pulumi.set(self, "skip_static_role_import_rotation", value)
|
|
646
|
+
|
|
647
|
+
@_builtins.property
|
|
648
|
+
@pulumi.getter
|
|
649
|
+
def starttls(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
650
|
+
"""
|
|
651
|
+
Issue a StartTLS command after establishing unencrypted connection.
|
|
652
|
+
"""
|
|
653
|
+
return pulumi.get(self, "starttls")
|
|
654
|
+
|
|
655
|
+
@starttls.setter
|
|
656
|
+
def starttls(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
657
|
+
pulumi.set(self, "starttls", value)
|
|
658
|
+
|
|
659
|
+
@_builtins.property
|
|
660
|
+
@pulumi.getter
|
|
661
|
+
def upndomain(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
662
|
+
"""
|
|
663
|
+
Enables userPrincipalDomain login with [username]@UPNDomain.
|
|
664
|
+
"""
|
|
665
|
+
return pulumi.get(self, "upndomain")
|
|
666
|
+
|
|
667
|
+
@upndomain.setter
|
|
668
|
+
def upndomain(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
669
|
+
pulumi.set(self, "upndomain", value)
|
|
670
|
+
|
|
671
|
+
@_builtins.property
|
|
672
|
+
@pulumi.getter
|
|
673
|
+
def url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
674
|
+
"""
|
|
675
|
+
LDAP URL to connect to. Multiple URLs can be specified by concatenating
|
|
676
|
+
them with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.
|
|
677
|
+
"""
|
|
678
|
+
return pulumi.get(self, "url")
|
|
679
|
+
|
|
680
|
+
@url.setter
|
|
681
|
+
def url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
682
|
+
pulumi.set(self, "url", value)
|
|
683
|
+
|
|
684
|
+
@_builtins.property
|
|
685
|
+
@pulumi.getter
|
|
686
|
+
def userattr(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
687
|
+
"""
|
|
688
|
+
Attribute used when searching users. Defaults to `cn`.
|
|
689
|
+
"""
|
|
690
|
+
return pulumi.get(self, "userattr")
|
|
691
|
+
|
|
692
|
+
@userattr.setter
|
|
693
|
+
def userattr(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
694
|
+
pulumi.set(self, "userattr", value)
|
|
695
|
+
|
|
696
|
+
@_builtins.property
|
|
697
|
+
@pulumi.getter
|
|
698
|
+
def userdn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
699
|
+
"""
|
|
700
|
+
LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.
|
|
701
|
+
"""
|
|
702
|
+
return pulumi.get(self, "userdn")
|
|
703
|
+
|
|
704
|
+
@userdn.setter
|
|
705
|
+
def userdn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
706
|
+
pulumi.set(self, "userdn", value)
|
|
707
|
+
|
|
708
|
+
|
|
709
|
+
@pulumi.input_type
|
|
710
|
+
class _SecretBackendState:
|
|
711
|
+
def __init__(__self__, *,
|
|
712
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
713
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
714
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
715
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
716
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
717
|
+
binddn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
718
|
+
bindpass: Optional[pulumi.Input[_builtins.str]] = None,
|
|
719
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
720
|
+
client_tls_cert: Optional[pulumi.Input[_builtins.str]] = None,
|
|
721
|
+
client_tls_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
722
|
+
connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
723
|
+
credential_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
724
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
725
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
726
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
727
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
728
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
729
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
730
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
731
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
732
|
+
insecure_tls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
733
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
734
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
735
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
736
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
737
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
738
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
739
|
+
password_policy: Optional[pulumi.Input[_builtins.str]] = None,
|
|
740
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
741
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
742
|
+
request_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
743
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
744
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
745
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
746
|
+
schema: Optional[pulumi.Input[_builtins.str]] = None,
|
|
747
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
748
|
+
skip_static_role_import_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
749
|
+
starttls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
750
|
+
upndomain: Optional[pulumi.Input[_builtins.str]] = None,
|
|
751
|
+
url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
752
|
+
userattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
753
|
+
userdn: Optional[pulumi.Input[_builtins.str]] = None):
|
|
754
|
+
"""
|
|
755
|
+
Input properties used for looking up and filtering SecretBackend resources.
|
|
756
|
+
:param pulumi.Input[_builtins.str] accessor: Accessor of the mount
|
|
757
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
758
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
759
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
760
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
761
|
+
:param pulumi.Input[_builtins.str] binddn: Distinguished name of object to bind when performing user and group search.
|
|
762
|
+
:param pulumi.Input[_builtins.str] bindpass: Password to use along with binddn when performing user search.
|
|
763
|
+
:param pulumi.Input[_builtins.str] certificate: CA certificate to use when verifying LDAP server certificate, must be
|
|
764
|
+
x509 PEM encoded.
|
|
765
|
+
:param pulumi.Input[_builtins.str] client_tls_cert: Client certificate to provide to the LDAP server, must be x509 PEM encoded.
|
|
766
|
+
:param pulumi.Input[_builtins.str] client_tls_key: Client certificate key to provide to the LDAP server, must be x509 PEM encoded.
|
|
767
|
+
:param pulumi.Input[_builtins.int] connection_timeout: Timeout, in seconds, when attempting to connect to the LDAP server before trying
|
|
768
|
+
the next URL in the configuration.
|
|
769
|
+
:param pulumi.Input[_builtins.str] credential_type: The type of credential to generate. Valid values include `password` and `phrase`. Default is `password`.
|
|
770
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
|
|
771
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
772
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount
|
|
773
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
774
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
775
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
776
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
777
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
|
|
778
|
+
:param pulumi.Input[_builtins.bool] insecure_tls: Skip LDAP server SSL Certificate verification. This is not recommended for production.
|
|
779
|
+
Defaults to `false`.
|
|
780
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
781
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
782
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
|
|
783
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
784
|
+
The value should not contain leading or trailing forward slashes.
|
|
785
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
786
|
+
*Available only for Vault Enterprise*.
|
|
787
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
788
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
789
|
+
:param pulumi.Input[_builtins.str] password_policy: Name of the password policy to use to generate passwords.
|
|
790
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
791
|
+
not begin or end with a `/`. Defaults to `ldap`.
|
|
792
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
793
|
+
:param pulumi.Input[_builtins.int] request_timeout: Timeout, in seconds, for the connection when making requests against the server
|
|
794
|
+
before returning back an error.
|
|
795
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
796
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
797
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
798
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
799
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
800
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
801
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
802
|
+
:param pulumi.Input[_builtins.str] schema: The LDAP schema to use when storing entry passwords. Valid schemas include `openldap`, `ad`, and `racf`. Default is `openldap`.
|
|
803
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
804
|
+
:param pulumi.Input[_builtins.bool] skip_static_role_import_rotation: If set to true, static roles will not be rotated during import.
|
|
805
|
+
Defaults to false. Requires Vault 1.16 or above.
|
|
806
|
+
:param pulumi.Input[_builtins.bool] starttls: Issue a StartTLS command after establishing unencrypted connection.
|
|
807
|
+
:param pulumi.Input[_builtins.str] upndomain: Enables userPrincipalDomain login with [username]@UPNDomain.
|
|
808
|
+
:param pulumi.Input[_builtins.str] url: LDAP URL to connect to. Multiple URLs can be specified by concatenating
|
|
809
|
+
them with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.
|
|
810
|
+
:param pulumi.Input[_builtins.str] userattr: Attribute used when searching users. Defaults to `cn`.
|
|
811
|
+
:param pulumi.Input[_builtins.str] userdn: LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.
|
|
812
|
+
"""
|
|
813
|
+
if accessor is not None:
|
|
814
|
+
pulumi.set(__self__, "accessor", accessor)
|
|
815
|
+
if allowed_managed_keys is not None:
|
|
816
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
817
|
+
if allowed_response_headers is not None:
|
|
818
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
819
|
+
if audit_non_hmac_request_keys is not None:
|
|
820
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
821
|
+
if audit_non_hmac_response_keys is not None:
|
|
822
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
823
|
+
if binddn is not None:
|
|
824
|
+
pulumi.set(__self__, "binddn", binddn)
|
|
825
|
+
if bindpass is not None:
|
|
826
|
+
pulumi.set(__self__, "bindpass", bindpass)
|
|
827
|
+
if certificate is not None:
|
|
828
|
+
pulumi.set(__self__, "certificate", certificate)
|
|
829
|
+
if client_tls_cert is not None:
|
|
830
|
+
pulumi.set(__self__, "client_tls_cert", client_tls_cert)
|
|
831
|
+
if client_tls_key is not None:
|
|
832
|
+
pulumi.set(__self__, "client_tls_key", client_tls_key)
|
|
833
|
+
if connection_timeout is not None:
|
|
834
|
+
pulumi.set(__self__, "connection_timeout", connection_timeout)
|
|
835
|
+
if credential_type is not None:
|
|
836
|
+
pulumi.set(__self__, "credential_type", credential_type)
|
|
837
|
+
if default_lease_ttl_seconds is not None:
|
|
838
|
+
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
839
|
+
if delegated_auth_accessors is not None:
|
|
840
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
841
|
+
if description is not None:
|
|
842
|
+
pulumi.set(__self__, "description", description)
|
|
843
|
+
if disable_automated_rotation is not None:
|
|
844
|
+
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
845
|
+
if disable_remount is not None:
|
|
846
|
+
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
847
|
+
if external_entropy_access is not None:
|
|
848
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
849
|
+
if force_no_cache is not None:
|
|
850
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
851
|
+
if identity_token_key is not None:
|
|
852
|
+
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
853
|
+
if insecure_tls is not None:
|
|
854
|
+
pulumi.set(__self__, "insecure_tls", insecure_tls)
|
|
855
|
+
if listing_visibility is not None:
|
|
856
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
857
|
+
if local is not None:
|
|
858
|
+
pulumi.set(__self__, "local", local)
|
|
859
|
+
if max_lease_ttl_seconds is not None:
|
|
860
|
+
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
861
|
+
if namespace is not None:
|
|
862
|
+
pulumi.set(__self__, "namespace", namespace)
|
|
863
|
+
if options is not None:
|
|
864
|
+
pulumi.set(__self__, "options", options)
|
|
865
|
+
if passthrough_request_headers is not None:
|
|
866
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
867
|
+
if password_policy is not None:
|
|
868
|
+
pulumi.set(__self__, "password_policy", password_policy)
|
|
869
|
+
if path is not None:
|
|
870
|
+
pulumi.set(__self__, "path", path)
|
|
871
|
+
if plugin_version is not None:
|
|
872
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
873
|
+
if request_timeout is not None:
|
|
874
|
+
pulumi.set(__self__, "request_timeout", request_timeout)
|
|
875
|
+
if rotation_period is not None:
|
|
876
|
+
pulumi.set(__self__, "rotation_period", rotation_period)
|
|
877
|
+
if rotation_schedule is not None:
|
|
878
|
+
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
879
|
+
if rotation_window is not None:
|
|
880
|
+
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
881
|
+
if schema is not None:
|
|
882
|
+
pulumi.set(__self__, "schema", schema)
|
|
883
|
+
if seal_wrap is not None:
|
|
884
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
885
|
+
if skip_static_role_import_rotation is not None:
|
|
886
|
+
pulumi.set(__self__, "skip_static_role_import_rotation", skip_static_role_import_rotation)
|
|
887
|
+
if starttls is not None:
|
|
888
|
+
pulumi.set(__self__, "starttls", starttls)
|
|
889
|
+
if upndomain is not None:
|
|
890
|
+
pulumi.set(__self__, "upndomain", upndomain)
|
|
891
|
+
if url is not None:
|
|
892
|
+
pulumi.set(__self__, "url", url)
|
|
893
|
+
if userattr is not None:
|
|
894
|
+
pulumi.set(__self__, "userattr", userattr)
|
|
895
|
+
if userdn is not None:
|
|
896
|
+
pulumi.set(__self__, "userdn", userdn)
|
|
897
|
+
|
|
898
|
+
@_builtins.property
|
|
899
|
+
@pulumi.getter
|
|
900
|
+
def accessor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
901
|
+
"""
|
|
902
|
+
Accessor of the mount
|
|
903
|
+
"""
|
|
904
|
+
return pulumi.get(self, "accessor")
|
|
905
|
+
|
|
906
|
+
@accessor.setter
|
|
907
|
+
def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
908
|
+
pulumi.set(self, "accessor", value)
|
|
909
|
+
|
|
910
|
+
@_builtins.property
|
|
911
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
912
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
913
|
+
"""
|
|
914
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
915
|
+
"""
|
|
916
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
917
|
+
|
|
918
|
+
@allowed_managed_keys.setter
|
|
919
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
920
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
921
|
+
|
|
922
|
+
@_builtins.property
|
|
923
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
924
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
925
|
+
"""
|
|
926
|
+
List of headers to allow and pass from the request to the plugin
|
|
927
|
+
"""
|
|
928
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
929
|
+
|
|
930
|
+
@allowed_response_headers.setter
|
|
931
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
932
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
933
|
+
|
|
934
|
+
@_builtins.property
|
|
935
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
936
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
937
|
+
"""
|
|
938
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
939
|
+
"""
|
|
940
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
941
|
+
|
|
942
|
+
@audit_non_hmac_request_keys.setter
|
|
943
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
944
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
945
|
+
|
|
946
|
+
@_builtins.property
|
|
947
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
948
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
949
|
+
"""
|
|
950
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
951
|
+
"""
|
|
952
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
953
|
+
|
|
954
|
+
@audit_non_hmac_response_keys.setter
|
|
955
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
956
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
957
|
+
|
|
958
|
+
@_builtins.property
|
|
959
|
+
@pulumi.getter
|
|
960
|
+
def binddn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
961
|
+
"""
|
|
962
|
+
Distinguished name of object to bind when performing user and group search.
|
|
963
|
+
"""
|
|
964
|
+
return pulumi.get(self, "binddn")
|
|
965
|
+
|
|
966
|
+
@binddn.setter
|
|
967
|
+
def binddn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
968
|
+
pulumi.set(self, "binddn", value)
|
|
969
|
+
|
|
970
|
+
@_builtins.property
|
|
971
|
+
@pulumi.getter
|
|
972
|
+
def bindpass(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
973
|
+
"""
|
|
974
|
+
Password to use along with binddn when performing user search.
|
|
975
|
+
"""
|
|
976
|
+
return pulumi.get(self, "bindpass")
|
|
977
|
+
|
|
978
|
+
@bindpass.setter
|
|
979
|
+
def bindpass(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
980
|
+
pulumi.set(self, "bindpass", value)
|
|
981
|
+
|
|
982
|
+
@_builtins.property
|
|
983
|
+
@pulumi.getter
|
|
984
|
+
def certificate(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
985
|
+
"""
|
|
986
|
+
CA certificate to use when verifying LDAP server certificate, must be
|
|
987
|
+
x509 PEM encoded.
|
|
988
|
+
"""
|
|
989
|
+
return pulumi.get(self, "certificate")
|
|
990
|
+
|
|
991
|
+
@certificate.setter
|
|
992
|
+
def certificate(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
993
|
+
pulumi.set(self, "certificate", value)
|
|
994
|
+
|
|
995
|
+
@_builtins.property
|
|
996
|
+
@pulumi.getter(name="clientTlsCert")
|
|
997
|
+
def client_tls_cert(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
998
|
+
"""
|
|
999
|
+
Client certificate to provide to the LDAP server, must be x509 PEM encoded.
|
|
1000
|
+
"""
|
|
1001
|
+
return pulumi.get(self, "client_tls_cert")
|
|
1002
|
+
|
|
1003
|
+
@client_tls_cert.setter
|
|
1004
|
+
def client_tls_cert(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1005
|
+
pulumi.set(self, "client_tls_cert", value)
|
|
1006
|
+
|
|
1007
|
+
@_builtins.property
|
|
1008
|
+
@pulumi.getter(name="clientTlsKey")
|
|
1009
|
+
def client_tls_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1010
|
+
"""
|
|
1011
|
+
Client certificate key to provide to the LDAP server, must be x509 PEM encoded.
|
|
1012
|
+
"""
|
|
1013
|
+
return pulumi.get(self, "client_tls_key")
|
|
1014
|
+
|
|
1015
|
+
@client_tls_key.setter
|
|
1016
|
+
def client_tls_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1017
|
+
pulumi.set(self, "client_tls_key", value)
|
|
1018
|
+
|
|
1019
|
+
@_builtins.property
|
|
1020
|
+
@pulumi.getter(name="connectionTimeout")
|
|
1021
|
+
def connection_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1022
|
+
"""
|
|
1023
|
+
Timeout, in seconds, when attempting to connect to the LDAP server before trying
|
|
1024
|
+
the next URL in the configuration.
|
|
1025
|
+
"""
|
|
1026
|
+
return pulumi.get(self, "connection_timeout")
|
|
1027
|
+
|
|
1028
|
+
@connection_timeout.setter
|
|
1029
|
+
def connection_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1030
|
+
pulumi.set(self, "connection_timeout", value)
|
|
1031
|
+
|
|
1032
|
+
@_builtins.property
|
|
1033
|
+
@pulumi.getter(name="credentialType")
|
|
1034
|
+
def credential_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1035
|
+
"""
|
|
1036
|
+
The type of credential to generate. Valid values include `password` and `phrase`. Default is `password`.
|
|
1037
|
+
"""
|
|
1038
|
+
return pulumi.get(self, "credential_type")
|
|
1039
|
+
|
|
1040
|
+
@credential_type.setter
|
|
1041
|
+
def credential_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1042
|
+
pulumi.set(self, "credential_type", value)
|
|
1043
|
+
|
|
1044
|
+
@_builtins.property
|
|
1045
|
+
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
1046
|
+
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1047
|
+
"""
|
|
1048
|
+
Default lease duration for tokens and secrets in seconds
|
|
1049
|
+
"""
|
|
1050
|
+
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
1051
|
+
|
|
1052
|
+
@default_lease_ttl_seconds.setter
|
|
1053
|
+
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1054
|
+
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
1055
|
+
|
|
1056
|
+
@_builtins.property
|
|
1057
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
1058
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
1059
|
+
"""
|
|
1060
|
+
List of headers to allow and pass from the request to the plugin
|
|
1061
|
+
"""
|
|
1062
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
1063
|
+
|
|
1064
|
+
@delegated_auth_accessors.setter
|
|
1065
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
1066
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
1067
|
+
|
|
1068
|
+
@_builtins.property
|
|
1069
|
+
@pulumi.getter
|
|
1070
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1071
|
+
"""
|
|
1072
|
+
Human-friendly description of the mount
|
|
1073
|
+
"""
|
|
1074
|
+
return pulumi.get(self, "description")
|
|
1075
|
+
|
|
1076
|
+
@description.setter
|
|
1077
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1078
|
+
pulumi.set(self, "description", value)
|
|
1079
|
+
|
|
1080
|
+
@_builtins.property
|
|
1081
|
+
@pulumi.getter(name="disableAutomatedRotation")
|
|
1082
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1083
|
+
"""
|
|
1084
|
+
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1085
|
+
"""
|
|
1086
|
+
return pulumi.get(self, "disable_automated_rotation")
|
|
1087
|
+
|
|
1088
|
+
@disable_automated_rotation.setter
|
|
1089
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1090
|
+
pulumi.set(self, "disable_automated_rotation", value)
|
|
1091
|
+
|
|
1092
|
+
@_builtins.property
|
|
1093
|
+
@pulumi.getter(name="disableRemount")
|
|
1094
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1095
|
+
"""
|
|
1096
|
+
If set, opts out of mount migration on path updates.
|
|
1097
|
+
"""
|
|
1098
|
+
return pulumi.get(self, "disable_remount")
|
|
1099
|
+
|
|
1100
|
+
@disable_remount.setter
|
|
1101
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1102
|
+
pulumi.set(self, "disable_remount", value)
|
|
1103
|
+
|
|
1104
|
+
@_builtins.property
|
|
1105
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
1106
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1107
|
+
"""
|
|
1108
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
1109
|
+
"""
|
|
1110
|
+
return pulumi.get(self, "external_entropy_access")
|
|
1111
|
+
|
|
1112
|
+
@external_entropy_access.setter
|
|
1113
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1114
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
1115
|
+
|
|
1116
|
+
@_builtins.property
|
|
1117
|
+
@pulumi.getter(name="forceNoCache")
|
|
1118
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1119
|
+
"""
|
|
1120
|
+
If set to true, disables caching.
|
|
1121
|
+
"""
|
|
1122
|
+
return pulumi.get(self, "force_no_cache")
|
|
1123
|
+
|
|
1124
|
+
@force_no_cache.setter
|
|
1125
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1126
|
+
pulumi.set(self, "force_no_cache", value)
|
|
1127
|
+
|
|
1128
|
+
@_builtins.property
|
|
1129
|
+
@pulumi.getter(name="identityTokenKey")
|
|
1130
|
+
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1131
|
+
"""
|
|
1132
|
+
The key to use for signing plugin workload identity tokens
|
|
1133
|
+
"""
|
|
1134
|
+
return pulumi.get(self, "identity_token_key")
|
|
1135
|
+
|
|
1136
|
+
@identity_token_key.setter
|
|
1137
|
+
def identity_token_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1138
|
+
pulumi.set(self, "identity_token_key", value)
|
|
1139
|
+
|
|
1140
|
+
@_builtins.property
|
|
1141
|
+
@pulumi.getter(name="insecureTls")
|
|
1142
|
+
def insecure_tls(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1143
|
+
"""
|
|
1144
|
+
Skip LDAP server SSL Certificate verification. This is not recommended for production.
|
|
1145
|
+
Defaults to `false`.
|
|
1146
|
+
"""
|
|
1147
|
+
return pulumi.get(self, "insecure_tls")
|
|
1148
|
+
|
|
1149
|
+
@insecure_tls.setter
|
|
1150
|
+
def insecure_tls(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1151
|
+
pulumi.set(self, "insecure_tls", value)
|
|
1152
|
+
|
|
1153
|
+
@_builtins.property
|
|
1154
|
+
@pulumi.getter(name="listingVisibility")
|
|
1155
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1156
|
+
"""
|
|
1157
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1158
|
+
"""
|
|
1159
|
+
return pulumi.get(self, "listing_visibility")
|
|
1160
|
+
|
|
1161
|
+
@listing_visibility.setter
|
|
1162
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1163
|
+
pulumi.set(self, "listing_visibility", value)
|
|
1164
|
+
|
|
1165
|
+
@_builtins.property
|
|
1166
|
+
@pulumi.getter
|
|
1167
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1168
|
+
"""
|
|
1169
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1170
|
+
"""
|
|
1171
|
+
return pulumi.get(self, "local")
|
|
1172
|
+
|
|
1173
|
+
@local.setter
|
|
1174
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1175
|
+
pulumi.set(self, "local", value)
|
|
1176
|
+
|
|
1177
|
+
@_builtins.property
|
|
1178
|
+
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
1179
|
+
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1180
|
+
"""
|
|
1181
|
+
Maximum possible lease duration for tokens and secrets in seconds
|
|
1182
|
+
"""
|
|
1183
|
+
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
1184
|
+
|
|
1185
|
+
@max_lease_ttl_seconds.setter
|
|
1186
|
+
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1187
|
+
pulumi.set(self, "max_lease_ttl_seconds", value)
|
|
1188
|
+
|
|
1189
|
+
@_builtins.property
|
|
1190
|
+
@pulumi.getter
|
|
1191
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1192
|
+
"""
|
|
1193
|
+
The namespace to provision the resource in.
|
|
1194
|
+
The value should not contain leading or trailing forward slashes.
|
|
1195
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1196
|
+
*Available only for Vault Enterprise*.
|
|
1197
|
+
"""
|
|
1198
|
+
return pulumi.get(self, "namespace")
|
|
1199
|
+
|
|
1200
|
+
@namespace.setter
|
|
1201
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1202
|
+
pulumi.set(self, "namespace", value)
|
|
1203
|
+
|
|
1204
|
+
@_builtins.property
|
|
1205
|
+
@pulumi.getter
|
|
1206
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
1207
|
+
"""
|
|
1208
|
+
Specifies mount type specific options that are passed to the backend
|
|
1209
|
+
"""
|
|
1210
|
+
return pulumi.get(self, "options")
|
|
1211
|
+
|
|
1212
|
+
@options.setter
|
|
1213
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
1214
|
+
pulumi.set(self, "options", value)
|
|
1215
|
+
|
|
1216
|
+
@_builtins.property
|
|
1217
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
1218
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
1219
|
+
"""
|
|
1220
|
+
List of headers to allow and pass from the request to the plugin
|
|
1221
|
+
"""
|
|
1222
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
1223
|
+
|
|
1224
|
+
@passthrough_request_headers.setter
|
|
1225
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
1226
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
1227
|
+
|
|
1228
|
+
@_builtins.property
|
|
1229
|
+
@pulumi.getter(name="passwordPolicy")
|
|
1230
|
+
def password_policy(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1231
|
+
"""
|
|
1232
|
+
Name of the password policy to use to generate passwords.
|
|
1233
|
+
"""
|
|
1234
|
+
return pulumi.get(self, "password_policy")
|
|
1235
|
+
|
|
1236
|
+
@password_policy.setter
|
|
1237
|
+
def password_policy(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1238
|
+
pulumi.set(self, "password_policy", value)
|
|
1239
|
+
|
|
1240
|
+
@_builtins.property
|
|
1241
|
+
@pulumi.getter
|
|
1242
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1243
|
+
"""
|
|
1244
|
+
The unique path this backend should be mounted at. Must
|
|
1245
|
+
not begin or end with a `/`. Defaults to `ldap`.
|
|
1246
|
+
"""
|
|
1247
|
+
return pulumi.get(self, "path")
|
|
1248
|
+
|
|
1249
|
+
@path.setter
|
|
1250
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1251
|
+
pulumi.set(self, "path", value)
|
|
1252
|
+
|
|
1253
|
+
@_builtins.property
|
|
1254
|
+
@pulumi.getter(name="pluginVersion")
|
|
1255
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1256
|
+
"""
|
|
1257
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1258
|
+
"""
|
|
1259
|
+
return pulumi.get(self, "plugin_version")
|
|
1260
|
+
|
|
1261
|
+
@plugin_version.setter
|
|
1262
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1263
|
+
pulumi.set(self, "plugin_version", value)
|
|
1264
|
+
|
|
1265
|
+
@_builtins.property
|
|
1266
|
+
@pulumi.getter(name="requestTimeout")
|
|
1267
|
+
def request_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1268
|
+
"""
|
|
1269
|
+
Timeout, in seconds, for the connection when making requests against the server
|
|
1270
|
+
before returning back an error.
|
|
1271
|
+
"""
|
|
1272
|
+
return pulumi.get(self, "request_timeout")
|
|
1273
|
+
|
|
1274
|
+
@request_timeout.setter
|
|
1275
|
+
def request_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1276
|
+
pulumi.set(self, "request_timeout", value)
|
|
1277
|
+
|
|
1278
|
+
@_builtins.property
|
|
1279
|
+
@pulumi.getter(name="rotationPeriod")
|
|
1280
|
+
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1281
|
+
"""
|
|
1282
|
+
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1283
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
1284
|
+
"""
|
|
1285
|
+
return pulumi.get(self, "rotation_period")
|
|
1286
|
+
|
|
1287
|
+
@rotation_period.setter
|
|
1288
|
+
def rotation_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1289
|
+
pulumi.set(self, "rotation_period", value)
|
|
1290
|
+
|
|
1291
|
+
@_builtins.property
|
|
1292
|
+
@pulumi.getter(name="rotationSchedule")
|
|
1293
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1294
|
+
"""
|
|
1295
|
+
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1296
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
1297
|
+
"""
|
|
1298
|
+
return pulumi.get(self, "rotation_schedule")
|
|
1299
|
+
|
|
1300
|
+
@rotation_schedule.setter
|
|
1301
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1302
|
+
pulumi.set(self, "rotation_schedule", value)
|
|
1303
|
+
|
|
1304
|
+
@_builtins.property
|
|
1305
|
+
@pulumi.getter(name="rotationWindow")
|
|
1306
|
+
def rotation_window(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1307
|
+
"""
|
|
1308
|
+
The maximum amount of time in seconds allowed to complete
|
|
1309
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
1310
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
1311
|
+
"""
|
|
1312
|
+
return pulumi.get(self, "rotation_window")
|
|
1313
|
+
|
|
1314
|
+
@rotation_window.setter
|
|
1315
|
+
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1316
|
+
pulumi.set(self, "rotation_window", value)
|
|
1317
|
+
|
|
1318
|
+
@_builtins.property
|
|
1319
|
+
@pulumi.getter
|
|
1320
|
+
def schema(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1321
|
+
"""
|
|
1322
|
+
The LDAP schema to use when storing entry passwords. Valid schemas include `openldap`, `ad`, and `racf`. Default is `openldap`.
|
|
1323
|
+
"""
|
|
1324
|
+
return pulumi.get(self, "schema")
|
|
1325
|
+
|
|
1326
|
+
@schema.setter
|
|
1327
|
+
def schema(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1328
|
+
pulumi.set(self, "schema", value)
|
|
1329
|
+
|
|
1330
|
+
@_builtins.property
|
|
1331
|
+
@pulumi.getter(name="sealWrap")
|
|
1332
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1333
|
+
"""
|
|
1334
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1335
|
+
"""
|
|
1336
|
+
return pulumi.get(self, "seal_wrap")
|
|
1337
|
+
|
|
1338
|
+
@seal_wrap.setter
|
|
1339
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1340
|
+
pulumi.set(self, "seal_wrap", value)
|
|
1341
|
+
|
|
1342
|
+
@_builtins.property
|
|
1343
|
+
@pulumi.getter(name="skipStaticRoleImportRotation")
|
|
1344
|
+
def skip_static_role_import_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1345
|
+
"""
|
|
1346
|
+
If set to true, static roles will not be rotated during import.
|
|
1347
|
+
Defaults to false. Requires Vault 1.16 or above.
|
|
1348
|
+
"""
|
|
1349
|
+
return pulumi.get(self, "skip_static_role_import_rotation")
|
|
1350
|
+
|
|
1351
|
+
@skip_static_role_import_rotation.setter
|
|
1352
|
+
def skip_static_role_import_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1353
|
+
pulumi.set(self, "skip_static_role_import_rotation", value)
|
|
1354
|
+
|
|
1355
|
+
@_builtins.property
|
|
1356
|
+
@pulumi.getter
|
|
1357
|
+
def starttls(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1358
|
+
"""
|
|
1359
|
+
Issue a StartTLS command after establishing unencrypted connection.
|
|
1360
|
+
"""
|
|
1361
|
+
return pulumi.get(self, "starttls")
|
|
1362
|
+
|
|
1363
|
+
@starttls.setter
|
|
1364
|
+
def starttls(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1365
|
+
pulumi.set(self, "starttls", value)
|
|
1366
|
+
|
|
1367
|
+
@_builtins.property
|
|
1368
|
+
@pulumi.getter
|
|
1369
|
+
def upndomain(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1370
|
+
"""
|
|
1371
|
+
Enables userPrincipalDomain login with [username]@UPNDomain.
|
|
1372
|
+
"""
|
|
1373
|
+
return pulumi.get(self, "upndomain")
|
|
1374
|
+
|
|
1375
|
+
@upndomain.setter
|
|
1376
|
+
def upndomain(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1377
|
+
pulumi.set(self, "upndomain", value)
|
|
1378
|
+
|
|
1379
|
+
@_builtins.property
|
|
1380
|
+
@pulumi.getter
|
|
1381
|
+
def url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1382
|
+
"""
|
|
1383
|
+
LDAP URL to connect to. Multiple URLs can be specified by concatenating
|
|
1384
|
+
them with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.
|
|
1385
|
+
"""
|
|
1386
|
+
return pulumi.get(self, "url")
|
|
1387
|
+
|
|
1388
|
+
@url.setter
|
|
1389
|
+
def url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1390
|
+
pulumi.set(self, "url", value)
|
|
1391
|
+
|
|
1392
|
+
@_builtins.property
|
|
1393
|
+
@pulumi.getter
|
|
1394
|
+
def userattr(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1395
|
+
"""
|
|
1396
|
+
Attribute used when searching users. Defaults to `cn`.
|
|
1397
|
+
"""
|
|
1398
|
+
return pulumi.get(self, "userattr")
|
|
1399
|
+
|
|
1400
|
+
@userattr.setter
|
|
1401
|
+
def userattr(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1402
|
+
pulumi.set(self, "userattr", value)
|
|
1403
|
+
|
|
1404
|
+
@_builtins.property
|
|
1405
|
+
@pulumi.getter
|
|
1406
|
+
def userdn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1407
|
+
"""
|
|
1408
|
+
LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.
|
|
1409
|
+
"""
|
|
1410
|
+
return pulumi.get(self, "userdn")
|
|
1411
|
+
|
|
1412
|
+
@userdn.setter
|
|
1413
|
+
def userdn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1414
|
+
pulumi.set(self, "userdn", value)
|
|
1415
|
+
|
|
1416
|
+
|
|
1417
|
+
@pulumi.type_token("vault:ldap/secretBackend:SecretBackend")
|
|
1418
|
+
class SecretBackend(pulumi.CustomResource):
|
|
1419
|
+
@overload
|
|
1420
|
+
def __init__(__self__,
|
|
1421
|
+
resource_name: str,
|
|
1422
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1423
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1424
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1425
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1426
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1427
|
+
binddn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1428
|
+
bindpass: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1429
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1430
|
+
client_tls_cert: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1431
|
+
client_tls_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1432
|
+
connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1433
|
+
credential_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1434
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1435
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1436
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1437
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1438
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1439
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1440
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1441
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1442
|
+
insecure_tls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1443
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1444
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1445
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1446
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1447
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1448
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1449
|
+
password_policy: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1450
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1451
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1452
|
+
request_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1453
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1454
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1455
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1456
|
+
schema: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1457
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1458
|
+
skip_static_role_import_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1459
|
+
starttls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1460
|
+
upndomain: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1461
|
+
url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1462
|
+
userattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1463
|
+
userdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1464
|
+
__props__=None):
|
|
1465
|
+
"""
|
|
1466
|
+
## Example Usage
|
|
1467
|
+
|
|
1468
|
+
```python
|
|
1469
|
+
import pulumi
|
|
1470
|
+
import pulumi_vault as vault
|
|
1471
|
+
|
|
1472
|
+
config = vault.ldap.SecretBackend("config",
|
|
1473
|
+
path="my-custom-ldap",
|
|
1474
|
+
binddn="CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
|
|
1475
|
+
bindpass="SuperSecretPassw0rd",
|
|
1476
|
+
url="ldaps://localhost",
|
|
1477
|
+
insecure_tls=True,
|
|
1478
|
+
userdn="CN=Users,DC=corp,DC=example,DC=net",
|
|
1479
|
+
rotation_schedule="0 * * * SAT",
|
|
1480
|
+
rotation_window=3600)
|
|
1481
|
+
```
|
|
1482
|
+
|
|
1483
|
+
## Import
|
|
1484
|
+
|
|
1485
|
+
LDAP secret backend can be imported using the `${mount}/config`, e.g.
|
|
1486
|
+
|
|
1487
|
+
```sh
|
|
1488
|
+
$ pulumi import vault:ldap/secretBackend:SecretBackend config ldap/config
|
|
1489
|
+
```
|
|
1490
|
+
|
|
1491
|
+
:param str resource_name: The name of the resource.
|
|
1492
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1493
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1494
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1495
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1496
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1497
|
+
:param pulumi.Input[_builtins.str] binddn: Distinguished name of object to bind when performing user and group search.
|
|
1498
|
+
:param pulumi.Input[_builtins.str] bindpass: Password to use along with binddn when performing user search.
|
|
1499
|
+
:param pulumi.Input[_builtins.str] certificate: CA certificate to use when verifying LDAP server certificate, must be
|
|
1500
|
+
x509 PEM encoded.
|
|
1501
|
+
:param pulumi.Input[_builtins.str] client_tls_cert: Client certificate to provide to the LDAP server, must be x509 PEM encoded.
|
|
1502
|
+
:param pulumi.Input[_builtins.str] client_tls_key: Client certificate key to provide to the LDAP server, must be x509 PEM encoded.
|
|
1503
|
+
:param pulumi.Input[_builtins.int] connection_timeout: Timeout, in seconds, when attempting to connect to the LDAP server before trying
|
|
1504
|
+
the next URL in the configuration.
|
|
1505
|
+
:param pulumi.Input[_builtins.str] credential_type: The type of credential to generate. Valid values include `password` and `phrase`. Default is `password`.
|
|
1506
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
|
|
1507
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1508
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount
|
|
1509
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1510
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
1511
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1512
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
1513
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
|
|
1514
|
+
:param pulumi.Input[_builtins.bool] insecure_tls: Skip LDAP server SSL Certificate verification. This is not recommended for production.
|
|
1515
|
+
Defaults to `false`.
|
|
1516
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1517
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1518
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
|
|
1519
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
1520
|
+
The value should not contain leading or trailing forward slashes.
|
|
1521
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1522
|
+
*Available only for Vault Enterprise*.
|
|
1523
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1524
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
1525
|
+
:param pulumi.Input[_builtins.str] password_policy: Name of the password policy to use to generate passwords.
|
|
1526
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
1527
|
+
not begin or end with a `/`. Defaults to `ldap`.
|
|
1528
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1529
|
+
:param pulumi.Input[_builtins.int] request_timeout: Timeout, in seconds, for the connection when making requests against the server
|
|
1530
|
+
before returning back an error.
|
|
1531
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1532
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
1533
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1534
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
1535
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
1536
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
1537
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
1538
|
+
:param pulumi.Input[_builtins.str] schema: The LDAP schema to use when storing entry passwords. Valid schemas include `openldap`, `ad`, and `racf`. Default is `openldap`.
|
|
1539
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1540
|
+
:param pulumi.Input[_builtins.bool] skip_static_role_import_rotation: If set to true, static roles will not be rotated during import.
|
|
1541
|
+
Defaults to false. Requires Vault 1.16 or above.
|
|
1542
|
+
:param pulumi.Input[_builtins.bool] starttls: Issue a StartTLS command after establishing unencrypted connection.
|
|
1543
|
+
:param pulumi.Input[_builtins.str] upndomain: Enables userPrincipalDomain login with [username]@UPNDomain.
|
|
1544
|
+
:param pulumi.Input[_builtins.str] url: LDAP URL to connect to. Multiple URLs can be specified by concatenating
|
|
1545
|
+
them with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.
|
|
1546
|
+
:param pulumi.Input[_builtins.str] userattr: Attribute used when searching users. Defaults to `cn`.
|
|
1547
|
+
:param pulumi.Input[_builtins.str] userdn: LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.
|
|
1548
|
+
"""
|
|
1549
|
+
...
|
|
1550
|
+
@overload
|
|
1551
|
+
def __init__(__self__,
|
|
1552
|
+
resource_name: str,
|
|
1553
|
+
args: SecretBackendArgs,
|
|
1554
|
+
opts: Optional[pulumi.ResourceOptions] = None):
|
|
1555
|
+
"""
|
|
1556
|
+
## Example Usage
|
|
1557
|
+
|
|
1558
|
+
```python
|
|
1559
|
+
import pulumi
|
|
1560
|
+
import pulumi_vault as vault
|
|
1561
|
+
|
|
1562
|
+
config = vault.ldap.SecretBackend("config",
|
|
1563
|
+
path="my-custom-ldap",
|
|
1564
|
+
binddn="CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
|
|
1565
|
+
bindpass="SuperSecretPassw0rd",
|
|
1566
|
+
url="ldaps://localhost",
|
|
1567
|
+
insecure_tls=True,
|
|
1568
|
+
userdn="CN=Users,DC=corp,DC=example,DC=net",
|
|
1569
|
+
rotation_schedule="0 * * * SAT",
|
|
1570
|
+
rotation_window=3600)
|
|
1571
|
+
```
|
|
1572
|
+
|
|
1573
|
+
## Import
|
|
1574
|
+
|
|
1575
|
+
LDAP secret backend can be imported using the `${mount}/config`, e.g.
|
|
1576
|
+
|
|
1577
|
+
```sh
|
|
1578
|
+
$ pulumi import vault:ldap/secretBackend:SecretBackend config ldap/config
|
|
1579
|
+
```
|
|
1580
|
+
|
|
1581
|
+
:param str resource_name: The name of the resource.
|
|
1582
|
+
:param SecretBackendArgs args: The arguments to use to populate this resource's properties.
|
|
1583
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1584
|
+
"""
|
|
1585
|
+
...
|
|
1586
|
+
def __init__(__self__, resource_name: str, *args, **kwargs):
|
|
1587
|
+
resource_args, opts = _utilities.get_resource_args_opts(SecretBackendArgs, pulumi.ResourceOptions, *args, **kwargs)
|
|
1588
|
+
if resource_args is not None:
|
|
1589
|
+
__self__._internal_init(resource_name, opts, **resource_args.__dict__)
|
|
1590
|
+
else:
|
|
1591
|
+
__self__._internal_init(resource_name, *args, **kwargs)
|
|
1592
|
+
|
|
1593
|
+
def _internal_init(__self__,
|
|
1594
|
+
resource_name: str,
|
|
1595
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1596
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1597
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1598
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1599
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1600
|
+
binddn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1601
|
+
bindpass: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1602
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1603
|
+
client_tls_cert: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1604
|
+
client_tls_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1605
|
+
connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1606
|
+
credential_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1607
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1608
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1609
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1610
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1611
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1612
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1613
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1614
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1615
|
+
insecure_tls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1616
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1617
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1618
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1619
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1620
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1621
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1622
|
+
password_policy: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1623
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1624
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1625
|
+
request_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1626
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1627
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1628
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1629
|
+
schema: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1630
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1631
|
+
skip_static_role_import_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1632
|
+
starttls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1633
|
+
upndomain: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1634
|
+
url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1635
|
+
userattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1636
|
+
userdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1637
|
+
__props__=None):
|
|
1638
|
+
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
1639
|
+
if not isinstance(opts, pulumi.ResourceOptions):
|
|
1640
|
+
raise TypeError('Expected resource options to be a ResourceOptions instance')
|
|
1641
|
+
if opts.id is None:
|
|
1642
|
+
if __props__ is not None:
|
|
1643
|
+
raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
|
|
1644
|
+
__props__ = SecretBackendArgs.__new__(SecretBackendArgs)
|
|
1645
|
+
|
|
1646
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1647
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1648
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1649
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
1650
|
+
if binddn is None and not opts.urn:
|
|
1651
|
+
raise TypeError("Missing required property 'binddn'")
|
|
1652
|
+
__props__.__dict__["binddn"] = binddn
|
|
1653
|
+
if bindpass is None and not opts.urn:
|
|
1654
|
+
raise TypeError("Missing required property 'bindpass'")
|
|
1655
|
+
__props__.__dict__["bindpass"] = None if bindpass is None else pulumi.Output.secret(bindpass)
|
|
1656
|
+
__props__.__dict__["certificate"] = certificate
|
|
1657
|
+
__props__.__dict__["client_tls_cert"] = None if client_tls_cert is None else pulumi.Output.secret(client_tls_cert)
|
|
1658
|
+
__props__.__dict__["client_tls_key"] = None if client_tls_key is None else pulumi.Output.secret(client_tls_key)
|
|
1659
|
+
__props__.__dict__["connection_timeout"] = connection_timeout
|
|
1660
|
+
__props__.__dict__["credential_type"] = credential_type
|
|
1661
|
+
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
1662
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
1663
|
+
__props__.__dict__["description"] = description
|
|
1664
|
+
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
1665
|
+
__props__.__dict__["disable_remount"] = disable_remount
|
|
1666
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1667
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
1668
|
+
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
1669
|
+
__props__.__dict__["insecure_tls"] = insecure_tls
|
|
1670
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
1671
|
+
__props__.__dict__["local"] = local
|
|
1672
|
+
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
1673
|
+
__props__.__dict__["namespace"] = namespace
|
|
1674
|
+
__props__.__dict__["options"] = options
|
|
1675
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
1676
|
+
__props__.__dict__["password_policy"] = password_policy
|
|
1677
|
+
__props__.__dict__["path"] = path
|
|
1678
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
1679
|
+
__props__.__dict__["request_timeout"] = request_timeout
|
|
1680
|
+
__props__.__dict__["rotation_period"] = rotation_period
|
|
1681
|
+
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
1682
|
+
__props__.__dict__["rotation_window"] = rotation_window
|
|
1683
|
+
__props__.__dict__["schema"] = schema
|
|
1684
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
1685
|
+
__props__.__dict__["skip_static_role_import_rotation"] = skip_static_role_import_rotation
|
|
1686
|
+
__props__.__dict__["starttls"] = starttls
|
|
1687
|
+
__props__.__dict__["upndomain"] = upndomain
|
|
1688
|
+
__props__.__dict__["url"] = url
|
|
1689
|
+
__props__.__dict__["userattr"] = userattr
|
|
1690
|
+
__props__.__dict__["userdn"] = userdn
|
|
1691
|
+
__props__.__dict__["accessor"] = None
|
|
1692
|
+
secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["bindpass", "clientTlsCert", "clientTlsKey"])
|
|
1693
|
+
opts = pulumi.ResourceOptions.merge(opts, secret_opts)
|
|
1694
|
+
super(SecretBackend, __self__).__init__(
|
|
1695
|
+
'vault:ldap/secretBackend:SecretBackend',
|
|
1696
|
+
resource_name,
|
|
1697
|
+
__props__,
|
|
1698
|
+
opts)
|
|
1699
|
+
|
|
1700
|
+
@staticmethod
|
|
1701
|
+
def get(resource_name: str,
|
|
1702
|
+
id: pulumi.Input[str],
|
|
1703
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1704
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1705
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1706
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1707
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1708
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1709
|
+
binddn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1710
|
+
bindpass: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1711
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1712
|
+
client_tls_cert: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1713
|
+
client_tls_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1714
|
+
connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1715
|
+
credential_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1716
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1717
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1718
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1719
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1720
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1721
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1722
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1723
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1724
|
+
insecure_tls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1725
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1726
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1727
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1728
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1729
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1730
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1731
|
+
password_policy: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1732
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1733
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1734
|
+
request_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1735
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1736
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1737
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1738
|
+
schema: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1739
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1740
|
+
skip_static_role_import_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1741
|
+
starttls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1742
|
+
upndomain: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1743
|
+
url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1744
|
+
userattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1745
|
+
userdn: Optional[pulumi.Input[_builtins.str]] = None) -> 'SecretBackend':
|
|
1746
|
+
"""
|
|
1747
|
+
Get an existing SecretBackend resource's state with the given name, id, and optional extra
|
|
1748
|
+
properties used to qualify the lookup.
|
|
1749
|
+
|
|
1750
|
+
:param str resource_name: The unique name of the resulting resource.
|
|
1751
|
+
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
1752
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1753
|
+
:param pulumi.Input[_builtins.str] accessor: Accessor of the mount
|
|
1754
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1755
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1756
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1757
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1758
|
+
:param pulumi.Input[_builtins.str] binddn: Distinguished name of object to bind when performing user and group search.
|
|
1759
|
+
:param pulumi.Input[_builtins.str] bindpass: Password to use along with binddn when performing user search.
|
|
1760
|
+
:param pulumi.Input[_builtins.str] certificate: CA certificate to use when verifying LDAP server certificate, must be
|
|
1761
|
+
x509 PEM encoded.
|
|
1762
|
+
:param pulumi.Input[_builtins.str] client_tls_cert: Client certificate to provide to the LDAP server, must be x509 PEM encoded.
|
|
1763
|
+
:param pulumi.Input[_builtins.str] client_tls_key: Client certificate key to provide to the LDAP server, must be x509 PEM encoded.
|
|
1764
|
+
:param pulumi.Input[_builtins.int] connection_timeout: Timeout, in seconds, when attempting to connect to the LDAP server before trying
|
|
1765
|
+
the next URL in the configuration.
|
|
1766
|
+
:param pulumi.Input[_builtins.str] credential_type: The type of credential to generate. Valid values include `password` and `phrase`. Default is `password`.
|
|
1767
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
|
|
1768
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1769
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount
|
|
1770
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1771
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
1772
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1773
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
1774
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
|
|
1775
|
+
:param pulumi.Input[_builtins.bool] insecure_tls: Skip LDAP server SSL Certificate verification. This is not recommended for production.
|
|
1776
|
+
Defaults to `false`.
|
|
1777
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1778
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1779
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
|
|
1780
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
1781
|
+
The value should not contain leading or trailing forward slashes.
|
|
1782
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1783
|
+
*Available only for Vault Enterprise*.
|
|
1784
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1785
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
1786
|
+
:param pulumi.Input[_builtins.str] password_policy: Name of the password policy to use to generate passwords.
|
|
1787
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
1788
|
+
not begin or end with a `/`. Defaults to `ldap`.
|
|
1789
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1790
|
+
:param pulumi.Input[_builtins.int] request_timeout: Timeout, in seconds, for the connection when making requests against the server
|
|
1791
|
+
before returning back an error.
|
|
1792
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1793
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
1794
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1795
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
1796
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
1797
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
1798
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
1799
|
+
:param pulumi.Input[_builtins.str] schema: The LDAP schema to use when storing entry passwords. Valid schemas include `openldap`, `ad`, and `racf`. Default is `openldap`.
|
|
1800
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1801
|
+
:param pulumi.Input[_builtins.bool] skip_static_role_import_rotation: If set to true, static roles will not be rotated during import.
|
|
1802
|
+
Defaults to false. Requires Vault 1.16 or above.
|
|
1803
|
+
:param pulumi.Input[_builtins.bool] starttls: Issue a StartTLS command after establishing unencrypted connection.
|
|
1804
|
+
:param pulumi.Input[_builtins.str] upndomain: Enables userPrincipalDomain login with [username]@UPNDomain.
|
|
1805
|
+
:param pulumi.Input[_builtins.str] url: LDAP URL to connect to. Multiple URLs can be specified by concatenating
|
|
1806
|
+
them with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.
|
|
1807
|
+
:param pulumi.Input[_builtins.str] userattr: Attribute used when searching users. Defaults to `cn`.
|
|
1808
|
+
:param pulumi.Input[_builtins.str] userdn: LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.
|
|
1809
|
+
"""
|
|
1810
|
+
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
1811
|
+
|
|
1812
|
+
__props__ = _SecretBackendState.__new__(_SecretBackendState)
|
|
1813
|
+
|
|
1814
|
+
__props__.__dict__["accessor"] = accessor
|
|
1815
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1816
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1817
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1818
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
1819
|
+
__props__.__dict__["binddn"] = binddn
|
|
1820
|
+
__props__.__dict__["bindpass"] = bindpass
|
|
1821
|
+
__props__.__dict__["certificate"] = certificate
|
|
1822
|
+
__props__.__dict__["client_tls_cert"] = client_tls_cert
|
|
1823
|
+
__props__.__dict__["client_tls_key"] = client_tls_key
|
|
1824
|
+
__props__.__dict__["connection_timeout"] = connection_timeout
|
|
1825
|
+
__props__.__dict__["credential_type"] = credential_type
|
|
1826
|
+
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
1827
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
1828
|
+
__props__.__dict__["description"] = description
|
|
1829
|
+
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
1830
|
+
__props__.__dict__["disable_remount"] = disable_remount
|
|
1831
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1832
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
1833
|
+
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
1834
|
+
__props__.__dict__["insecure_tls"] = insecure_tls
|
|
1835
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
1836
|
+
__props__.__dict__["local"] = local
|
|
1837
|
+
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
1838
|
+
__props__.__dict__["namespace"] = namespace
|
|
1839
|
+
__props__.__dict__["options"] = options
|
|
1840
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
1841
|
+
__props__.__dict__["password_policy"] = password_policy
|
|
1842
|
+
__props__.__dict__["path"] = path
|
|
1843
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
1844
|
+
__props__.__dict__["request_timeout"] = request_timeout
|
|
1845
|
+
__props__.__dict__["rotation_period"] = rotation_period
|
|
1846
|
+
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
1847
|
+
__props__.__dict__["rotation_window"] = rotation_window
|
|
1848
|
+
__props__.__dict__["schema"] = schema
|
|
1849
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
1850
|
+
__props__.__dict__["skip_static_role_import_rotation"] = skip_static_role_import_rotation
|
|
1851
|
+
__props__.__dict__["starttls"] = starttls
|
|
1852
|
+
__props__.__dict__["upndomain"] = upndomain
|
|
1853
|
+
__props__.__dict__["url"] = url
|
|
1854
|
+
__props__.__dict__["userattr"] = userattr
|
|
1855
|
+
__props__.__dict__["userdn"] = userdn
|
|
1856
|
+
return SecretBackend(resource_name, opts=opts, __props__=__props__)
|
|
1857
|
+
|
|
1858
|
+
@_builtins.property
|
|
1859
|
+
@pulumi.getter
|
|
1860
|
+
def accessor(self) -> pulumi.Output[_builtins.str]:
|
|
1861
|
+
"""
|
|
1862
|
+
Accessor of the mount
|
|
1863
|
+
"""
|
|
1864
|
+
return pulumi.get(self, "accessor")
|
|
1865
|
+
|
|
1866
|
+
@_builtins.property
|
|
1867
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
1868
|
+
def allowed_managed_keys(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1869
|
+
"""
|
|
1870
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
1871
|
+
"""
|
|
1872
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
1873
|
+
|
|
1874
|
+
@_builtins.property
|
|
1875
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
1876
|
+
def allowed_response_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1877
|
+
"""
|
|
1878
|
+
List of headers to allow and pass from the request to the plugin
|
|
1879
|
+
"""
|
|
1880
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
1881
|
+
|
|
1882
|
+
@_builtins.property
|
|
1883
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
1884
|
+
def audit_non_hmac_request_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1885
|
+
"""
|
|
1886
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1887
|
+
"""
|
|
1888
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
1889
|
+
|
|
1890
|
+
@_builtins.property
|
|
1891
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
1892
|
+
def audit_non_hmac_response_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1893
|
+
"""
|
|
1894
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1895
|
+
"""
|
|
1896
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
1897
|
+
|
|
1898
|
+
@_builtins.property
|
|
1899
|
+
@pulumi.getter
|
|
1900
|
+
def binddn(self) -> pulumi.Output[_builtins.str]:
|
|
1901
|
+
"""
|
|
1902
|
+
Distinguished name of object to bind when performing user and group search.
|
|
1903
|
+
"""
|
|
1904
|
+
return pulumi.get(self, "binddn")
|
|
1905
|
+
|
|
1906
|
+
@_builtins.property
|
|
1907
|
+
@pulumi.getter
|
|
1908
|
+
def bindpass(self) -> pulumi.Output[_builtins.str]:
|
|
1909
|
+
"""
|
|
1910
|
+
Password to use along with binddn when performing user search.
|
|
1911
|
+
"""
|
|
1912
|
+
return pulumi.get(self, "bindpass")
|
|
1913
|
+
|
|
1914
|
+
@_builtins.property
|
|
1915
|
+
@pulumi.getter
|
|
1916
|
+
def certificate(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1917
|
+
"""
|
|
1918
|
+
CA certificate to use when verifying LDAP server certificate, must be
|
|
1919
|
+
x509 PEM encoded.
|
|
1920
|
+
"""
|
|
1921
|
+
return pulumi.get(self, "certificate")
|
|
1922
|
+
|
|
1923
|
+
@_builtins.property
|
|
1924
|
+
@pulumi.getter(name="clientTlsCert")
|
|
1925
|
+
def client_tls_cert(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1926
|
+
"""
|
|
1927
|
+
Client certificate to provide to the LDAP server, must be x509 PEM encoded.
|
|
1928
|
+
"""
|
|
1929
|
+
return pulumi.get(self, "client_tls_cert")
|
|
1930
|
+
|
|
1931
|
+
@_builtins.property
|
|
1932
|
+
@pulumi.getter(name="clientTlsKey")
|
|
1933
|
+
def client_tls_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1934
|
+
"""
|
|
1935
|
+
Client certificate key to provide to the LDAP server, must be x509 PEM encoded.
|
|
1936
|
+
"""
|
|
1937
|
+
return pulumi.get(self, "client_tls_key")
|
|
1938
|
+
|
|
1939
|
+
@_builtins.property
|
|
1940
|
+
@pulumi.getter(name="connectionTimeout")
|
|
1941
|
+
def connection_timeout(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1942
|
+
"""
|
|
1943
|
+
Timeout, in seconds, when attempting to connect to the LDAP server before trying
|
|
1944
|
+
the next URL in the configuration.
|
|
1945
|
+
"""
|
|
1946
|
+
return pulumi.get(self, "connection_timeout")
|
|
1947
|
+
|
|
1948
|
+
@_builtins.property
|
|
1949
|
+
@pulumi.getter(name="credentialType")
|
|
1950
|
+
def credential_type(self) -> pulumi.Output[_builtins.str]:
|
|
1951
|
+
"""
|
|
1952
|
+
The type of credential to generate. Valid values include `password` and `phrase`. Default is `password`.
|
|
1953
|
+
"""
|
|
1954
|
+
return pulumi.get(self, "credential_type")
|
|
1955
|
+
|
|
1956
|
+
@_builtins.property
|
|
1957
|
+
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
1958
|
+
def default_lease_ttl_seconds(self) -> pulumi.Output[_builtins.int]:
|
|
1959
|
+
"""
|
|
1960
|
+
Default lease duration for tokens and secrets in seconds
|
|
1961
|
+
"""
|
|
1962
|
+
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
1963
|
+
|
|
1964
|
+
@_builtins.property
|
|
1965
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
1966
|
+
def delegated_auth_accessors(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1967
|
+
"""
|
|
1968
|
+
List of headers to allow and pass from the request to the plugin
|
|
1969
|
+
"""
|
|
1970
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
1971
|
+
|
|
1972
|
+
@_builtins.property
|
|
1973
|
+
@pulumi.getter
|
|
1974
|
+
def description(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1975
|
+
"""
|
|
1976
|
+
Human-friendly description of the mount
|
|
1977
|
+
"""
|
|
1978
|
+
return pulumi.get(self, "description")
|
|
1979
|
+
|
|
1980
|
+
@_builtins.property
|
|
1981
|
+
@pulumi.getter(name="disableAutomatedRotation")
|
|
1982
|
+
def disable_automated_rotation(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1983
|
+
"""
|
|
1984
|
+
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1985
|
+
"""
|
|
1986
|
+
return pulumi.get(self, "disable_automated_rotation")
|
|
1987
|
+
|
|
1988
|
+
@_builtins.property
|
|
1989
|
+
@pulumi.getter(name="disableRemount")
|
|
1990
|
+
def disable_remount(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1991
|
+
"""
|
|
1992
|
+
If set, opts out of mount migration on path updates.
|
|
1993
|
+
"""
|
|
1994
|
+
return pulumi.get(self, "disable_remount")
|
|
1995
|
+
|
|
1996
|
+
@_builtins.property
|
|
1997
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
1998
|
+
def external_entropy_access(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1999
|
+
"""
|
|
2000
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
2001
|
+
"""
|
|
2002
|
+
return pulumi.get(self, "external_entropy_access")
|
|
2003
|
+
|
|
2004
|
+
@_builtins.property
|
|
2005
|
+
@pulumi.getter(name="forceNoCache")
|
|
2006
|
+
def force_no_cache(self) -> pulumi.Output[_builtins.bool]:
|
|
2007
|
+
"""
|
|
2008
|
+
If set to true, disables caching.
|
|
2009
|
+
"""
|
|
2010
|
+
return pulumi.get(self, "force_no_cache")
|
|
2011
|
+
|
|
2012
|
+
@_builtins.property
|
|
2013
|
+
@pulumi.getter(name="identityTokenKey")
|
|
2014
|
+
def identity_token_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2015
|
+
"""
|
|
2016
|
+
The key to use for signing plugin workload identity tokens
|
|
2017
|
+
"""
|
|
2018
|
+
return pulumi.get(self, "identity_token_key")
|
|
2019
|
+
|
|
2020
|
+
@_builtins.property
|
|
2021
|
+
@pulumi.getter(name="insecureTls")
|
|
2022
|
+
def insecure_tls(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
2023
|
+
"""
|
|
2024
|
+
Skip LDAP server SSL Certificate verification. This is not recommended for production.
|
|
2025
|
+
Defaults to `false`.
|
|
2026
|
+
"""
|
|
2027
|
+
return pulumi.get(self, "insecure_tls")
|
|
2028
|
+
|
|
2029
|
+
@_builtins.property
|
|
2030
|
+
@pulumi.getter(name="listingVisibility")
|
|
2031
|
+
def listing_visibility(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2032
|
+
"""
|
|
2033
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
2034
|
+
"""
|
|
2035
|
+
return pulumi.get(self, "listing_visibility")
|
|
2036
|
+
|
|
2037
|
+
@_builtins.property
|
|
2038
|
+
@pulumi.getter
|
|
2039
|
+
def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
2040
|
+
"""
|
|
2041
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
2042
|
+
"""
|
|
2043
|
+
return pulumi.get(self, "local")
|
|
2044
|
+
|
|
2045
|
+
@_builtins.property
|
|
2046
|
+
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
2047
|
+
def max_lease_ttl_seconds(self) -> pulumi.Output[_builtins.int]:
|
|
2048
|
+
"""
|
|
2049
|
+
Maximum possible lease duration for tokens and secrets in seconds
|
|
2050
|
+
"""
|
|
2051
|
+
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
2052
|
+
|
|
2053
|
+
@_builtins.property
|
|
2054
|
+
@pulumi.getter
|
|
2055
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2056
|
+
"""
|
|
2057
|
+
The namespace to provision the resource in.
|
|
2058
|
+
The value should not contain leading or trailing forward slashes.
|
|
2059
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
2060
|
+
*Available only for Vault Enterprise*.
|
|
2061
|
+
"""
|
|
2062
|
+
return pulumi.get(self, "namespace")
|
|
2063
|
+
|
|
2064
|
+
@_builtins.property
|
|
2065
|
+
@pulumi.getter
|
|
2066
|
+
def options(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
2067
|
+
"""
|
|
2068
|
+
Specifies mount type specific options that are passed to the backend
|
|
2069
|
+
"""
|
|
2070
|
+
return pulumi.get(self, "options")
|
|
2071
|
+
|
|
2072
|
+
@_builtins.property
|
|
2073
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
2074
|
+
def passthrough_request_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
2075
|
+
"""
|
|
2076
|
+
List of headers to allow and pass from the request to the plugin
|
|
2077
|
+
"""
|
|
2078
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
2079
|
+
|
|
2080
|
+
@_builtins.property
|
|
2081
|
+
@pulumi.getter(name="passwordPolicy")
|
|
2082
|
+
def password_policy(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2083
|
+
"""
|
|
2084
|
+
Name of the password policy to use to generate passwords.
|
|
2085
|
+
"""
|
|
2086
|
+
return pulumi.get(self, "password_policy")
|
|
2087
|
+
|
|
2088
|
+
@_builtins.property
|
|
2089
|
+
@pulumi.getter
|
|
2090
|
+
def path(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2091
|
+
"""
|
|
2092
|
+
The unique path this backend should be mounted at. Must
|
|
2093
|
+
not begin or end with a `/`. Defaults to `ldap`.
|
|
2094
|
+
"""
|
|
2095
|
+
return pulumi.get(self, "path")
|
|
2096
|
+
|
|
2097
|
+
@_builtins.property
|
|
2098
|
+
@pulumi.getter(name="pluginVersion")
|
|
2099
|
+
def plugin_version(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2100
|
+
"""
|
|
2101
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
2102
|
+
"""
|
|
2103
|
+
return pulumi.get(self, "plugin_version")
|
|
2104
|
+
|
|
2105
|
+
@_builtins.property
|
|
2106
|
+
@pulumi.getter(name="requestTimeout")
|
|
2107
|
+
def request_timeout(self) -> pulumi.Output[_builtins.int]:
|
|
2108
|
+
"""
|
|
2109
|
+
Timeout, in seconds, for the connection when making requests against the server
|
|
2110
|
+
before returning back an error.
|
|
2111
|
+
"""
|
|
2112
|
+
return pulumi.get(self, "request_timeout")
|
|
2113
|
+
|
|
2114
|
+
@_builtins.property
|
|
2115
|
+
@pulumi.getter(name="rotationPeriod")
|
|
2116
|
+
def rotation_period(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
2117
|
+
"""
|
|
2118
|
+
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
2119
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
2120
|
+
"""
|
|
2121
|
+
return pulumi.get(self, "rotation_period")
|
|
2122
|
+
|
|
2123
|
+
@_builtins.property
|
|
2124
|
+
@pulumi.getter(name="rotationSchedule")
|
|
2125
|
+
def rotation_schedule(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2126
|
+
"""
|
|
2127
|
+
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
2128
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
2129
|
+
"""
|
|
2130
|
+
return pulumi.get(self, "rotation_schedule")
|
|
2131
|
+
|
|
2132
|
+
@_builtins.property
|
|
2133
|
+
@pulumi.getter(name="rotationWindow")
|
|
2134
|
+
def rotation_window(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
2135
|
+
"""
|
|
2136
|
+
The maximum amount of time in seconds allowed to complete
|
|
2137
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
2138
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
2139
|
+
"""
|
|
2140
|
+
return pulumi.get(self, "rotation_window")
|
|
2141
|
+
|
|
2142
|
+
@_builtins.property
|
|
2143
|
+
@pulumi.getter
|
|
2144
|
+
def schema(self) -> pulumi.Output[_builtins.str]:
|
|
2145
|
+
"""
|
|
2146
|
+
The LDAP schema to use when storing entry passwords. Valid schemas include `openldap`, `ad`, and `racf`. Default is `openldap`.
|
|
2147
|
+
"""
|
|
2148
|
+
return pulumi.get(self, "schema")
|
|
2149
|
+
|
|
2150
|
+
@_builtins.property
|
|
2151
|
+
@pulumi.getter(name="sealWrap")
|
|
2152
|
+
def seal_wrap(self) -> pulumi.Output[_builtins.bool]:
|
|
2153
|
+
"""
|
|
2154
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
2155
|
+
"""
|
|
2156
|
+
return pulumi.get(self, "seal_wrap")
|
|
2157
|
+
|
|
2158
|
+
@_builtins.property
|
|
2159
|
+
@pulumi.getter(name="skipStaticRoleImportRotation")
|
|
2160
|
+
def skip_static_role_import_rotation(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
2161
|
+
"""
|
|
2162
|
+
If set to true, static roles will not be rotated during import.
|
|
2163
|
+
Defaults to false. Requires Vault 1.16 or above.
|
|
2164
|
+
"""
|
|
2165
|
+
return pulumi.get(self, "skip_static_role_import_rotation")
|
|
2166
|
+
|
|
2167
|
+
@_builtins.property
|
|
2168
|
+
@pulumi.getter
|
|
2169
|
+
def starttls(self) -> pulumi.Output[_builtins.bool]:
|
|
2170
|
+
"""
|
|
2171
|
+
Issue a StartTLS command after establishing unencrypted connection.
|
|
2172
|
+
"""
|
|
2173
|
+
return pulumi.get(self, "starttls")
|
|
2174
|
+
|
|
2175
|
+
@_builtins.property
|
|
2176
|
+
@pulumi.getter
|
|
2177
|
+
def upndomain(self) -> pulumi.Output[_builtins.str]:
|
|
2178
|
+
"""
|
|
2179
|
+
Enables userPrincipalDomain login with [username]@UPNDomain.
|
|
2180
|
+
"""
|
|
2181
|
+
return pulumi.get(self, "upndomain")
|
|
2182
|
+
|
|
2183
|
+
@_builtins.property
|
|
2184
|
+
@pulumi.getter
|
|
2185
|
+
def url(self) -> pulumi.Output[_builtins.str]:
|
|
2186
|
+
"""
|
|
2187
|
+
LDAP URL to connect to. Multiple URLs can be specified by concatenating
|
|
2188
|
+
them with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.
|
|
2189
|
+
"""
|
|
2190
|
+
return pulumi.get(self, "url")
|
|
2191
|
+
|
|
2192
|
+
@_builtins.property
|
|
2193
|
+
@pulumi.getter
|
|
2194
|
+
def userattr(self) -> pulumi.Output[_builtins.str]:
|
|
2195
|
+
"""
|
|
2196
|
+
Attribute used when searching users. Defaults to `cn`.
|
|
2197
|
+
"""
|
|
2198
|
+
return pulumi.get(self, "userattr")
|
|
2199
|
+
|
|
2200
|
+
@_builtins.property
|
|
2201
|
+
@pulumi.getter
|
|
2202
|
+
def userdn(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2203
|
+
"""
|
|
2204
|
+
LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.
|
|
2205
|
+
"""
|
|
2206
|
+
return pulumi.get(self, "userdn")
|
|
2207
|
+
|