pulumi-vault 7.6.0a1764657486__py3-none-any.whl

pulumi_vault/azure/backend_role.py

@@ -0,0 +1,883 @@
+# coding=utf-8
+# *** WARNING: this file was generated by pulumi-language-python. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import builtins as _builtins
+import warnings
+import sys
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+if sys.version_info >= (3, 11):
+    from typing import NotRequired, TypedDict, TypeAlias
+else:
+    from typing_extensions import NotRequired, TypedDict, TypeAlias
+from .. import _utilities
+from . import outputs
+from ._inputs import *
+
+__all__ = ['BackendRoleArgs', 'BackendRole']
+
+@pulumi.input_type
+class BackendRoleArgs:
+    def __init__(__self__, *,
+                 role: pulumi.Input[_builtins.str],
+                 application_object_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 azure_groups: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]] = None,
+                 azure_roles: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]] = None,
+                 backend: Optional[pulumi.Input[_builtins.str]] = None,
+                 description: Optional[pulumi.Input[_builtins.str]] = None,
+                 explicit_max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
+                 max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
+                 namespace: Optional[pulumi.Input[_builtins.str]] = None,
+                 permanently_delete: Optional[pulumi.Input[_builtins.bool]] = None,
+                 persist_app: Optional[pulumi.Input[_builtins.bool]] = None,
+                 sign_in_audience: Optional[pulumi.Input[_builtins.str]] = None,
+                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 ttl: Optional[pulumi.Input[_builtins.str]] = None):
+        """
+        The set of arguments for constructing a BackendRole resource.
+        :param pulumi.Input[_builtins.str] role: Name of the Azure role
+        :param pulumi.Input[_builtins.str] application_object_id: Application Object ID for an existing service principal that will
+               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
+        :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]] azure_groups: List of Azure groups to be assigned to the generated service principal.
+        :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]] azure_roles: List of Azure roles to be assigned to the generated service principal.
+        :param pulumi.Input[_builtins.str] backend: Path to the mounted Azure auth backend
+        :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
+        :param pulumi.Input[_builtins.str] explicit_max_ttl: Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
+        :param pulumi.Input[_builtins.str] max_ttl: Specifies the maximum TTL for service principals generated using this role. Accepts time
+               suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
+        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
+               The value should not contain leading or trailing forward slashes.
+               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
+               *Available only for Vault Enterprise*.
+        :param pulumi.Input[_builtins.bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
+               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
+        :param pulumi.Input[_builtins.bool] persist_app: If set to true, persists the created service principal and application for the lifetime of the role
+        :param pulumi.Input[_builtins.str] sign_in_audience: Specifies the security principal types that are allowed to sign in to the application.
+               Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] tags: A list of Azure tags to attach to an application. Requires Vault 1.16+.
+        :param pulumi.Input[_builtins.str] ttl: Specifies the default TTL for service principals generated using this role.
+               Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
+        """
+        pulumi.set(__self__, "role", role)
+        if application_object_id is not None:
+            pulumi.set(__self__, "application_object_id", application_object_id)
+        if azure_groups is not None:
+            pulumi.set(__self__, "azure_groups", azure_groups)
+        if azure_roles is not None:
+            pulumi.set(__self__, "azure_roles", azure_roles)
+        if backend is not None:
+            pulumi.set(__self__, "backend", backend)
+        if description is not None:
+            pulumi.set(__self__, "description", description)
+        if explicit_max_ttl is not None:
+            pulumi.set(__self__, "explicit_max_ttl", explicit_max_ttl)
+        if max_ttl is not None:
+            pulumi.set(__self__, "max_ttl", max_ttl)
+        if namespace is not None:
+            pulumi.set(__self__, "namespace", namespace)
+        if permanently_delete is not None:
+            pulumi.set(__self__, "permanently_delete", permanently_delete)
+        if persist_app is not None:
+            pulumi.set(__self__, "persist_app", persist_app)
+        if sign_in_audience is not None:
+            pulumi.set(__self__, "sign_in_audience", sign_in_audience)
+        if tags is not None:
+            pulumi.set(__self__, "tags", tags)
+        if ttl is not None:
+            pulumi.set(__self__, "ttl", ttl)
+
+    @_builtins.property
+    @pulumi.getter
+    def role(self) -> pulumi.Input[_builtins.str]:
+        """
+        Name of the Azure role
+        """
+        return pulumi.get(self, "role")
+
+    @role.setter
+    def role(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "role", value)
+
+    @_builtins.property
+    @pulumi.getter(name="applicationObjectId")
+    def application_object_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Application Object ID for an existing service principal that will
+        be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
+        """
+        return pulumi.get(self, "application_object_id")
+
+    @application_object_id.setter
+    def application_object_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "application_object_id", value)
+
+    @_builtins.property
+    @pulumi.getter(name="azureGroups")
+    def azure_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]]:
+        """
+        List of Azure groups to be assigned to the generated service principal.
+        """
+        return pulumi.get(self, "azure_groups")
+
+    @azure_groups.setter
+    def azure_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]]):
+        pulumi.set(self, "azure_groups", value)
+
+    @_builtins.property
+    @pulumi.getter(name="azureRoles")
+    def azure_roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]]:
+        """
+        List of Azure roles to be assigned to the generated service principal.
+        """
+        return pulumi.get(self, "azure_roles")
+
+    @azure_roles.setter
+    def azure_roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]]):
+        pulumi.set(self, "azure_roles", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Path to the mounted Azure auth backend
+        """
+        return pulumi.get(self, "backend")
+
+    @backend.setter
+    def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "backend", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def description(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Human-friendly description of the mount for the backend.
+        """
+        return pulumi.get(self, "description")
+
+    @description.setter
+    def description(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "description", value)
+
+    @_builtins.property
+    @pulumi.getter(name="explicitMaxTtl")
+    def explicit_max_ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
+        """
+        return pulumi.get(self, "explicit_max_ttl")
+
+    @explicit_max_ttl.setter
+    def explicit_max_ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "explicit_max_ttl", value)
+
+    @_builtins.property
+    @pulumi.getter(name="maxTtl")
+    def max_ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Specifies the maximum TTL for service principals generated using this role. Accepts time
+        suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
+        """
+        return pulumi.get(self, "max_ttl")
+
+    @max_ttl.setter
+    def max_ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "max_ttl", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        The namespace to provision the resource in.
+        The value should not contain leading or trailing forward slashes.
+        The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
+        *Available only for Vault Enterprise*.
+        """
+        return pulumi.get(self, "namespace")
+
+    @namespace.setter
+    def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "namespace", value)
+
+    @_builtins.property
+    @pulumi.getter(name="permanentlyDelete")
+    def permanently_delete(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Indicates whether the applications and service principals created by Vault will be permanently
+        deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
+        """
+        return pulumi.get(self, "permanently_delete")
+
+    @permanently_delete.setter
+    def permanently_delete(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "permanently_delete", value)
+
+    @_builtins.property
+    @pulumi.getter(name="persistApp")
+    def persist_app(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        If set to true, persists the created service principal and application for the lifetime of the role
+        """
+        return pulumi.get(self, "persist_app")
+
+    @persist_app.setter
+    def persist_app(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "persist_app", value)
+
+    @_builtins.property
+    @pulumi.getter(name="signInAudience")
+    def sign_in_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Specifies the security principal types that are allowed to sign in to the application.
+        Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
+        """
+        return pulumi.get(self, "sign_in_audience")
+
+    @sign_in_audience.setter
+    def sign_in_audience(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "sign_in_audience", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def tags(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+        """
+        A list of Azure tags to attach to an application. Requires Vault 1.16+.
+        """
+        return pulumi.get(self, "tags")
+
+    @tags.setter
+    def tags(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
+        pulumi.set(self, "tags", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Specifies the default TTL for service principals generated using this role.
+        Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
+        """
+        return pulumi.get(self, "ttl")
+
+    @ttl.setter
+    def ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "ttl", value)
+
+
+@pulumi.input_type
+class _BackendRoleState:
+    def __init__(__self__, *,
+                 application_object_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 azure_groups: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]] = None,
+                 azure_roles: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]] = None,
+                 backend: Optional[pulumi.Input[_builtins.str]] = None,
+                 description: Optional[pulumi.Input[_builtins.str]] = None,
+                 explicit_max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
+                 max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
+                 namespace: Optional[pulumi.Input[_builtins.str]] = None,
+                 permanently_delete: Optional[pulumi.Input[_builtins.bool]] = None,
+                 persist_app: Optional[pulumi.Input[_builtins.bool]] = None,
+                 role: Optional[pulumi.Input[_builtins.str]] = None,
+                 sign_in_audience: Optional[pulumi.Input[_builtins.str]] = None,
+                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 ttl: Optional[pulumi.Input[_builtins.str]] = None):
+        """
+        Input properties used for looking up and filtering BackendRole resources.
+        :param pulumi.Input[_builtins.str] application_object_id: Application Object ID for an existing service principal that will
+               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
+        :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]] azure_groups: List of Azure groups to be assigned to the generated service principal.
+        :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]] azure_roles: List of Azure roles to be assigned to the generated service principal.
+        :param pulumi.Input[_builtins.str] backend: Path to the mounted Azure auth backend
+        :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
+        :param pulumi.Input[_builtins.str] explicit_max_ttl: Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
+        :param pulumi.Input[_builtins.str] max_ttl: Specifies the maximum TTL for service principals generated using this role. Accepts time
+               suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
+        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
+               The value should not contain leading or trailing forward slashes.
+               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
+               *Available only for Vault Enterprise*.
+        :param pulumi.Input[_builtins.bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
+               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
+        :param pulumi.Input[_builtins.bool] persist_app: If set to true, persists the created service principal and application for the lifetime of the role
+        :param pulumi.Input[_builtins.str] role: Name of the Azure role
+        :param pulumi.Input[_builtins.str] sign_in_audience: Specifies the security principal types that are allowed to sign in to the application.
+               Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] tags: A list of Azure tags to attach to an application. Requires Vault 1.16+.
+        :param pulumi.Input[_builtins.str] ttl: Specifies the default TTL for service principals generated using this role.
+               Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
+        """
+        if application_object_id is not None:
+            pulumi.set(__self__, "application_object_id", application_object_id)
+        if azure_groups is not None:
+            pulumi.set(__self__, "azure_groups", azure_groups)
+        if azure_roles is not None:
+            pulumi.set(__self__, "azure_roles", azure_roles)
+        if backend is not None:
+            pulumi.set(__self__, "backend", backend)
+        if description is not None:
+            pulumi.set(__self__, "description", description)
+        if explicit_max_ttl is not None:
+            pulumi.set(__self__, "explicit_max_ttl", explicit_max_ttl)
+        if max_ttl is not None:
+            pulumi.set(__self__, "max_ttl", max_ttl)
+        if namespace is not None:
+            pulumi.set(__self__, "namespace", namespace)
+        if permanently_delete is not None:
+            pulumi.set(__self__, "permanently_delete", permanently_delete)
+        if persist_app is not None:
+            pulumi.set(__self__, "persist_app", persist_app)
+        if role is not None:
+            pulumi.set(__self__, "role", role)
+        if sign_in_audience is not None:
+            pulumi.set(__self__, "sign_in_audience", sign_in_audience)
+        if tags is not None:
+            pulumi.set(__self__, "tags", tags)
+        if ttl is not None:
+            pulumi.set(__self__, "ttl", ttl)
+
+    @_builtins.property
+    @pulumi.getter(name="applicationObjectId")
+    def application_object_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Application Object ID for an existing service principal that will
+        be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
+        """
+        return pulumi.get(self, "application_object_id")
+
+    @application_object_id.setter
+    def application_object_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "application_object_id", value)
+
+    @_builtins.property
+    @pulumi.getter(name="azureGroups")
+    def azure_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]]:
+        """
+        List of Azure groups to be assigned to the generated service principal.
+        """
+        return pulumi.get(self, "azure_groups")
+
+    @azure_groups.setter
+    def azure_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]]):
+        pulumi.set(self, "azure_groups", value)
+
+    @_builtins.property
+    @pulumi.getter(name="azureRoles")
+    def azure_roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]]:
+        """
+        List of Azure roles to be assigned to the generated service principal.
+        """
+        return pulumi.get(self, "azure_roles")
+
+    @azure_roles.setter
+    def azure_roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]]):
+        pulumi.set(self, "azure_roles", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Path to the mounted Azure auth backend
+        """
+        return pulumi.get(self, "backend")
+
+    @backend.setter
+    def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "backend", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def description(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Human-friendly description of the mount for the backend.
+        """
+        return pulumi.get(self, "description")
+
+    @description.setter
+    def description(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "description", value)
+
+    @_builtins.property
+    @pulumi.getter(name="explicitMaxTtl")
+    def explicit_max_ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
+        """
+        return pulumi.get(self, "explicit_max_ttl")
+
+    @explicit_max_ttl.setter
+    def explicit_max_ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "explicit_max_ttl", value)
+
+    @_builtins.property
+    @pulumi.getter(name="maxTtl")
+    def max_ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Specifies the maximum TTL for service principals generated using this role. Accepts time
+        suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
+        """
+        return pulumi.get(self, "max_ttl")
+
+    @max_ttl.setter
+    def max_ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "max_ttl", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        The namespace to provision the resource in.
+        The value should not contain leading or trailing forward slashes.
+        The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
+        *Available only for Vault Enterprise*.
+        """
+        return pulumi.get(self, "namespace")
+
+    @namespace.setter
+    def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "namespace", value)
+
+    @_builtins.property
+    @pulumi.getter(name="permanentlyDelete")
+    def permanently_delete(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Indicates whether the applications and service principals created by Vault will be permanently
+        deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
+        """
+        return pulumi.get(self, "permanently_delete")
+
+    @permanently_delete.setter
+    def permanently_delete(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "permanently_delete", value)
+
+    @_builtins.property
+    @pulumi.getter(name="persistApp")
+    def persist_app(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        If set to true, persists the created service principal and application for the lifetime of the role
+        """
+        return pulumi.get(self, "persist_app")
+
+    @persist_app.setter
+    def persist_app(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "persist_app", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def role(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Name of the Azure role
+        """
+        return pulumi.get(self, "role")
+
+    @role.setter
+    def role(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "role", value)
+
+    @_builtins.property
+    @pulumi.getter(name="signInAudience")
+    def sign_in_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Specifies the security principal types that are allowed to sign in to the application.
+        Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
+        """
+        return pulumi.get(self, "sign_in_audience")
+
+    @sign_in_audience.setter
+    def sign_in_audience(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "sign_in_audience", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def tags(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+        """
+        A list of Azure tags to attach to an application. Requires Vault 1.16+.
+        """
+        return pulumi.get(self, "tags")
+
+    @tags.setter
+    def tags(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
+        pulumi.set(self, "tags", value)
+
+    @_builtins.property
+    @pulumi.getter
+    def ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Specifies the default TTL for service principals generated using this role.
+        Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
+        """
+        return pulumi.get(self, "ttl")
+
+    @ttl.setter
+    def ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "ttl", value)
+
+
+@pulumi.type_token("vault:azure/backendRole:BackendRole")
+class BackendRole(pulumi.CustomResource):
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 application_object_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 azure_groups: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureGroupArgs', 'BackendRoleAzureGroupArgsDict']]]]] = None,
+                 azure_roles: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureRoleArgs', 'BackendRoleAzureRoleArgsDict']]]]] = None,
+                 backend: Optional[pulumi.Input[_builtins.str]] = None,
+                 description: Optional[pulumi.Input[_builtins.str]] = None,
+                 explicit_max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
+                 max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
+                 namespace: Optional[pulumi.Input[_builtins.str]] = None,
+                 permanently_delete: Optional[pulumi.Input[_builtins.bool]] = None,
+                 persist_app: Optional[pulumi.Input[_builtins.bool]] = None,
+                 role: Optional[pulumi.Input[_builtins.str]] = None,
+                 sign_in_audience: Optional[pulumi.Input[_builtins.str]] = None,
+                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 ttl: Optional[pulumi.Input[_builtins.str]] = None,
+                 __props__=None):
+        """
+        ## Example Usage
+
+        ```python
+        import pulumi
+        import pulumi_vault as vault
+
+        azure = vault.azure.Backend("azure",
+            subscription_id=subscription_id,
+            tenant_id=tenant_id,
+            client_secret=client_secret,
+            client_id=client_id)
+        generated_role = vault.azure.BackendRole("generated_role",
+            backend=azure.path,
+            role="generated_role",
+            sign_in_audience="AzureADMyOrg",
+            tags=[
+                "team:engineering",
+                "environment:development",
+            ],
+            ttl="300",
+            max_ttl="600",
+            azure_roles=[{
+                "role_name": "Reader",
+                "scope": f"/subscriptions/{subscription_id}/resourceGroups/azure-vault-group",
+            }])
+        existing_object_id = vault.azure.BackendRole("existing_object_id",
+            backend=azure.path,
+            role="existing_object_id",
+            application_object_id="11111111-2222-3333-4444-44444444444",
+            ttl="300",
+            max_ttl="600")
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[_builtins.str] application_object_id: Application Object ID for an existing service principal that will
+               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
+        :param pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureGroupArgs', 'BackendRoleAzureGroupArgsDict']]]] azure_groups: List of Azure groups to be assigned to the generated service principal.
+        :param pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureRoleArgs', 'BackendRoleAzureRoleArgsDict']]]] azure_roles: List of Azure roles to be assigned to the generated service principal.
+        :param pulumi.Input[_builtins.str] backend: Path to the mounted Azure auth backend
+        :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
+        :param pulumi.Input[_builtins.str] explicit_max_ttl: Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
+        :param pulumi.Input[_builtins.str] max_ttl: Specifies the maximum TTL for service principals generated using this role. Accepts time
+               suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
+        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
+               The value should not contain leading or trailing forward slashes.
+               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
+               *Available only for Vault Enterprise*.
+        :param pulumi.Input[_builtins.bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
+               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
+        :param pulumi.Input[_builtins.bool] persist_app: If set to true, persists the created service principal and application for the lifetime of the role
+        :param pulumi.Input[_builtins.str] role: Name of the Azure role
+        :param pulumi.Input[_builtins.str] sign_in_audience: Specifies the security principal types that are allowed to sign in to the application.
+               Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] tags: A list of Azure tags to attach to an application. Requires Vault 1.16+.
+        :param pulumi.Input[_builtins.str] ttl: Specifies the default TTL for service principals generated using this role.
+               Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
+        """
+        ...
+    @overload
+    def __init__(__self__,
+                 resource_name: str,
+                 args: BackendRoleArgs,
+                 opts: Optional[pulumi.ResourceOptions] = None):
+        """
+        ## Example Usage
+
+        ```python
+        import pulumi
+        import pulumi_vault as vault
+
+        azure = vault.azure.Backend("azure",
+            subscription_id=subscription_id,
+            tenant_id=tenant_id,
+            client_secret=client_secret,
+            client_id=client_id)
+        generated_role = vault.azure.BackendRole("generated_role",
+            backend=azure.path,
+            role="generated_role",
+            sign_in_audience="AzureADMyOrg",
+            tags=[
+                "team:engineering",
+                "environment:development",
+            ],
+            ttl="300",
+            max_ttl="600",
+            azure_roles=[{
+                "role_name": "Reader",
+                "scope": f"/subscriptions/{subscription_id}/resourceGroups/azure-vault-group",
+            }])
+        existing_object_id = vault.azure.BackendRole("existing_object_id",
+            backend=azure.path,
+            role="existing_object_id",
+            application_object_id="11111111-2222-3333-4444-44444444444",
+            ttl="300",
+            max_ttl="600")
+        ```
+
+        :param str resource_name: The name of the resource.
+        :param BackendRoleArgs args: The arguments to use to populate this resource's properties.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        """
+        ...
+    def __init__(__self__, resource_name: str, *args, **kwargs):
+        resource_args, opts = _utilities.get_resource_args_opts(BackendRoleArgs, pulumi.ResourceOptions, *args, **kwargs)
+        if resource_args is not None:
+            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
+        else:
+            __self__._internal_init(resource_name, *args, **kwargs)
+
+    def _internal_init(__self__,
+                 resource_name: str,
+                 opts: Optional[pulumi.ResourceOptions] = None,
+                 application_object_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 azure_groups: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureGroupArgs', 'BackendRoleAzureGroupArgsDict']]]]] = None,
+                 azure_roles: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureRoleArgs', 'BackendRoleAzureRoleArgsDict']]]]] = None,
+                 backend: Optional[pulumi.Input[_builtins.str]] = None,
+                 description: Optional[pulumi.Input[_builtins.str]] = None,
+                 explicit_max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
+                 max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
+                 namespace: Optional[pulumi.Input[_builtins.str]] = None,
+                 permanently_delete: Optional[pulumi.Input[_builtins.bool]] = None,
+                 persist_app: Optional[pulumi.Input[_builtins.bool]] = None,
+                 role: Optional[pulumi.Input[_builtins.str]] = None,
+                 sign_in_audience: Optional[pulumi.Input[_builtins.str]] = None,
+                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 ttl: Optional[pulumi.Input[_builtins.str]] = None,
+                 __props__=None):
+        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
+        if not isinstance(opts, pulumi.ResourceOptions):
+            raise TypeError('Expected resource options to be a ResourceOptions instance')
+        if opts.id is None:
+            if __props__ is not None:
+                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
+            __props__ = BackendRoleArgs.__new__(BackendRoleArgs)
+
+            __props__.__dict__["application_object_id"] = application_object_id
+            __props__.__dict__["azure_groups"] = azure_groups
+            __props__.__dict__["azure_roles"] = azure_roles
+            __props__.__dict__["backend"] = backend
+            __props__.__dict__["description"] = description
+            __props__.__dict__["explicit_max_ttl"] = explicit_max_ttl
+            __props__.__dict__["max_ttl"] = max_ttl
+            __props__.__dict__["namespace"] = namespace
+            __props__.__dict__["permanently_delete"] = permanently_delete
+            __props__.__dict__["persist_app"] = persist_app
+            if role is None and not opts.urn:
+                raise TypeError("Missing required property 'role'")
+            __props__.__dict__["role"] = role
+            __props__.__dict__["sign_in_audience"] = sign_in_audience
+            __props__.__dict__["tags"] = tags
+            __props__.__dict__["ttl"] = ttl
+        super(BackendRole, __self__).__init__(
+            'vault:azure/backendRole:BackendRole',
+            resource_name,
+            __props__,
+            opts)
+
+    @staticmethod
+    def get(resource_name: str,
+            id: pulumi.Input[str],
+            opts: Optional[pulumi.ResourceOptions] = None,
+            application_object_id: Optional[pulumi.Input[_builtins.str]] = None,
+            azure_groups: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureGroupArgs', 'BackendRoleAzureGroupArgsDict']]]]] = None,
+            azure_roles: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureRoleArgs', 'BackendRoleAzureRoleArgsDict']]]]] = None,
+            backend: Optional[pulumi.Input[_builtins.str]] = None,
+            description: Optional[pulumi.Input[_builtins.str]] = None,
+            explicit_max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
+            max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
+            namespace: Optional[pulumi.Input[_builtins.str]] = None,
+            permanently_delete: Optional[pulumi.Input[_builtins.bool]] = None,
+            persist_app: Optional[pulumi.Input[_builtins.bool]] = None,
+            role: Optional[pulumi.Input[_builtins.str]] = None,
+            sign_in_audience: Optional[pulumi.Input[_builtins.str]] = None,
+            tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+            ttl: Optional[pulumi.Input[_builtins.str]] = None) -> 'BackendRole':
+        """
+        Get an existing BackendRole resource's state with the given name, id, and optional extra
+        properties used to qualify the lookup.
+
+        :param str resource_name: The unique name of the resulting resource.
+        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
+        :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[_builtins.str] application_object_id: Application Object ID for an existing service principal that will
+               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
+        :param pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureGroupArgs', 'BackendRoleAzureGroupArgsDict']]]] azure_groups: List of Azure groups to be assigned to the generated service principal.
+        :param pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureRoleArgs', 'BackendRoleAzureRoleArgsDict']]]] azure_roles: List of Azure roles to be assigned to the generated service principal.
+        :param pulumi.Input[_builtins.str] backend: Path to the mounted Azure auth backend
+        :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
+        :param pulumi.Input[_builtins.str] explicit_max_ttl: Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
+        :param pulumi.Input[_builtins.str] max_ttl: Specifies the maximum TTL for service principals generated using this role. Accepts time
+               suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
+        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
+               The value should not contain leading or trailing forward slashes.
+               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
+               *Available only for Vault Enterprise*.
+        :param pulumi.Input[_builtins.bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
+               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
+        :param pulumi.Input[_builtins.bool] persist_app: If set to true, persists the created service principal and application for the lifetime of the role
+        :param pulumi.Input[_builtins.str] role: Name of the Azure role
+        :param pulumi.Input[_builtins.str] sign_in_audience: Specifies the security principal types that are allowed to sign in to the application.
+               Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] tags: A list of Azure tags to attach to an application. Requires Vault 1.16+.
+        :param pulumi.Input[_builtins.str] ttl: Specifies the default TTL for service principals generated using this role.
+               Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
+        """
+        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
+
+        __props__ = _BackendRoleState.__new__(_BackendRoleState)
+
+        __props__.__dict__["application_object_id"] = application_object_id
+        __props__.__dict__["azure_groups"] = azure_groups
+        __props__.__dict__["azure_roles"] = azure_roles
+        __props__.__dict__["backend"] = backend
+        __props__.__dict__["description"] = description
+        __props__.__dict__["explicit_max_ttl"] = explicit_max_ttl
+        __props__.__dict__["max_ttl"] = max_ttl
+        __props__.__dict__["namespace"] = namespace
+        __props__.__dict__["permanently_delete"] = permanently_delete
+        __props__.__dict__["persist_app"] = persist_app
+        __props__.__dict__["role"] = role
+        __props__.__dict__["sign_in_audience"] = sign_in_audience
+        __props__.__dict__["tags"] = tags
+        __props__.__dict__["ttl"] = ttl
+        return BackendRole(resource_name, opts=opts, __props__=__props__)
+
+    @_builtins.property
+    @pulumi.getter(name="applicationObjectId")
+    def application_object_id(self) -> pulumi.Output[Optional[_builtins.str]]:
+        """
+        Application Object ID for an existing service principal that will
+        be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
+        """
+        return pulumi.get(self, "application_object_id")
+
+    @_builtins.property
+    @pulumi.getter(name="azureGroups")
+    def azure_groups(self) -> pulumi.Output[Optional[Sequence['outputs.BackendRoleAzureGroup']]]:
+        """
+        List of Azure groups to be assigned to the generated service principal.
+        """
+        return pulumi.get(self, "azure_groups")
+
+    @_builtins.property
+    @pulumi.getter(name="azureRoles")
+    def azure_roles(self) -> pulumi.Output[Optional[Sequence['outputs.BackendRoleAzureRole']]]:
+        """
+        List of Azure roles to be assigned to the generated service principal.
+        """
+        return pulumi.get(self, "azure_roles")
+
+    @_builtins.property
+    @pulumi.getter
+    def backend(self) -> pulumi.Output[Optional[_builtins.str]]:
+        """
+        Path to the mounted Azure auth backend
+        """
+        return pulumi.get(self, "backend")
+
+    @_builtins.property
+    @pulumi.getter
+    def description(self) -> pulumi.Output[Optional[_builtins.str]]:
+        """
+        Human-friendly description of the mount for the backend.
+        """
+        return pulumi.get(self, "description")
+
+    @_builtins.property
+    @pulumi.getter(name="explicitMaxTtl")
+    def explicit_max_ttl(self) -> pulumi.Output[Optional[_builtins.str]]:
+        """
+        Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
+        """
+        return pulumi.get(self, "explicit_max_ttl")
+
+    @_builtins.property
+    @pulumi.getter(name="maxTtl")
+    def max_ttl(self) -> pulumi.Output[Optional[_builtins.str]]:
+        """
+        Specifies the maximum TTL for service principals generated using this role. Accepts time
+        suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
+        """
+        return pulumi.get(self, "max_ttl")
+
+    @_builtins.property
+    @pulumi.getter
+    def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
+        """
+        The namespace to provision the resource in.
+        The value should not contain leading or trailing forward slashes.
+        The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
+        *Available only for Vault Enterprise*.
+        """
+        return pulumi.get(self, "namespace")
+
+    @_builtins.property
+    @pulumi.getter(name="permanentlyDelete")
+    def permanently_delete(self) -> pulumi.Output[_builtins.bool]:
+        """
+        Indicates whether the applications and service principals created by Vault will be permanently
+        deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
+        """
+        return pulumi.get(self, "permanently_delete")
+
+    @_builtins.property
+    @pulumi.getter(name="persistApp")
+    def persist_app(self) -> pulumi.Output[Optional[_builtins.bool]]:
+        """
+        If set to true, persists the created service principal and application for the lifetime of the role
+        """
+        return pulumi.get(self, "persist_app")
+
+    @_builtins.property
+    @pulumi.getter
+    def role(self) -> pulumi.Output[_builtins.str]:
+        """
+        Name of the Azure role
+        """
+        return pulumi.get(self, "role")
+
+    @_builtins.property
+    @pulumi.getter(name="signInAudience")
+    def sign_in_audience(self) -> pulumi.Output[Optional[_builtins.str]]:
+        """
+        Specifies the security principal types that are allowed to sign in to the application.
+        Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
+        """
+        return pulumi.get(self, "sign_in_audience")
+
+    @_builtins.property
+    @pulumi.getter
+    def tags(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
+        """
+        A list of Azure tags to attach to an application. Requires Vault 1.16+.
+        """
+        return pulumi.get(self, "tags")
+
+    @_builtins.property
+    @pulumi.getter
+    def ttl(self) -> pulumi.Output[Optional[_builtins.str]]:
+        """
+        Specifies the default TTL for service principals generated using this role.
+        Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
+        """
+        return pulumi.get(self, "ttl")
+