pulumi-vault 7.6.0a1764657486__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +1399 -0
- pulumi_vault/_inputs.py +2701 -0
- pulumi_vault/_utilities.py +331 -0
- pulumi_vault/ad/__init__.py +12 -0
- pulumi_vault/ad/get_access_credentials.py +177 -0
- pulumi_vault/ad/secret_backend.py +1916 -0
- pulumi_vault/ad/secret_library.py +546 -0
- pulumi_vault/ad/secret_role.py +499 -0
- pulumi_vault/alicloud/__init__.py +9 -0
- pulumi_vault/alicloud/auth_backend_role.py +866 -0
- pulumi_vault/approle/__init__.py +12 -0
- pulumi_vault/approle/auth_backend_login.py +571 -0
- pulumi_vault/approle/auth_backend_role.py +1082 -0
- pulumi_vault/approle/auth_backend_role_secret_id.py +796 -0
- pulumi_vault/approle/get_auth_backend_role_id.py +169 -0
- pulumi_vault/audit.py +499 -0
- pulumi_vault/audit_request_header.py +277 -0
- pulumi_vault/auth_backend.py +565 -0
- pulumi_vault/aws/__init__.py +22 -0
- pulumi_vault/aws/auth_backend_cert.py +420 -0
- pulumi_vault/aws/auth_backend_client.py +1259 -0
- pulumi_vault/aws/auth_backend_config_identity.py +494 -0
- pulumi_vault/aws/auth_backend_identity_whitelist.py +380 -0
- pulumi_vault/aws/auth_backend_login.py +1046 -0
- pulumi_vault/aws/auth_backend_role.py +1961 -0
- pulumi_vault/aws/auth_backend_role_tag.py +638 -0
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +366 -0
- pulumi_vault/aws/auth_backend_sts_role.py +414 -0
- pulumi_vault/aws/get_access_credentials.py +369 -0
- pulumi_vault/aws/get_static_access_credentials.py +137 -0
- pulumi_vault/aws/secret_backend.py +2018 -0
- pulumi_vault/aws/secret_backend_role.py +1188 -0
- pulumi_vault/aws/secret_backend_static_role.py +639 -0
- pulumi_vault/azure/__init__.py +15 -0
- pulumi_vault/azure/_inputs.py +108 -0
- pulumi_vault/azure/auth_backend_config.py +1096 -0
- pulumi_vault/azure/auth_backend_role.py +1176 -0
- pulumi_vault/azure/backend.py +1793 -0
- pulumi_vault/azure/backend_role.py +883 -0
- pulumi_vault/azure/get_access_credentials.py +400 -0
- pulumi_vault/azure/outputs.py +107 -0
- pulumi_vault/cert_auth_backend_role.py +1539 -0
- pulumi_vault/config/__init__.py +9 -0
- pulumi_vault/config/__init__.pyi +164 -0
- pulumi_vault/config/_inputs.py +73 -0
- pulumi_vault/config/outputs.py +1225 -0
- pulumi_vault/config/ui_custom_message.py +530 -0
- pulumi_vault/config/vars.py +230 -0
- pulumi_vault/consul/__init__.py +10 -0
- pulumi_vault/consul/secret_backend.py +1517 -0
- pulumi_vault/consul/secret_backend_role.py +847 -0
- pulumi_vault/database/__init__.py +14 -0
- pulumi_vault/database/_inputs.py +11907 -0
- pulumi_vault/database/outputs.py +8496 -0
- pulumi_vault/database/secret_backend_connection.py +1676 -0
- pulumi_vault/database/secret_backend_role.py +840 -0
- pulumi_vault/database/secret_backend_static_role.py +881 -0
- pulumi_vault/database/secrets_mount.py +2160 -0
- pulumi_vault/egp_policy.py +399 -0
- pulumi_vault/gcp/__init__.py +17 -0
- pulumi_vault/gcp/_inputs.py +441 -0
- pulumi_vault/gcp/auth_backend.py +1486 -0
- pulumi_vault/gcp/auth_backend_role.py +1235 -0
- pulumi_vault/gcp/get_auth_backend_role.py +514 -0
- pulumi_vault/gcp/outputs.py +302 -0
- pulumi_vault/gcp/secret_backend.py +1807 -0
- pulumi_vault/gcp/secret_impersonated_account.py +484 -0
- pulumi_vault/gcp/secret_roleset.py +554 -0
- pulumi_vault/gcp/secret_static_account.py +557 -0
- pulumi_vault/generic/__init__.py +11 -0
- pulumi_vault/generic/endpoint.py +786 -0
- pulumi_vault/generic/get_secret.py +306 -0
- pulumi_vault/generic/secret.py +486 -0
- pulumi_vault/get_auth_backend.py +226 -0
- pulumi_vault/get_auth_backends.py +170 -0
- pulumi_vault/get_namespace.py +226 -0
- pulumi_vault/get_namespaces.py +202 -0
- pulumi_vault/get_nomad_access_token.py +210 -0
- pulumi_vault/get_policy_document.py +160 -0
- pulumi_vault/get_raft_autopilot_state.py +267 -0
- pulumi_vault/github/__init__.py +13 -0
- pulumi_vault/github/_inputs.py +225 -0
- pulumi_vault/github/auth_backend.py +1194 -0
- pulumi_vault/github/outputs.py +174 -0
- pulumi_vault/github/team.py +380 -0
- pulumi_vault/github/user.py +380 -0
- pulumi_vault/identity/__init__.py +35 -0
- pulumi_vault/identity/entity.py +447 -0
- pulumi_vault/identity/entity_alias.py +398 -0
- pulumi_vault/identity/entity_policies.py +455 -0
- pulumi_vault/identity/get_entity.py +384 -0
- pulumi_vault/identity/get_group.py +467 -0
- pulumi_vault/identity/get_oidc_client_creds.py +175 -0
- pulumi_vault/identity/get_oidc_openid_config.py +334 -0
- pulumi_vault/identity/get_oidc_public_keys.py +179 -0
- pulumi_vault/identity/group.py +805 -0
- pulumi_vault/identity/group_alias.py +386 -0
- pulumi_vault/identity/group_member_entity_ids.py +444 -0
- pulumi_vault/identity/group_member_group_ids.py +467 -0
- pulumi_vault/identity/group_policies.py +471 -0
- pulumi_vault/identity/mfa_duo.py +674 -0
- pulumi_vault/identity/mfa_login_enforcement.py +566 -0
- pulumi_vault/identity/mfa_okta.py +626 -0
- pulumi_vault/identity/mfa_pingid.py +616 -0
- pulumi_vault/identity/mfa_totp.py +758 -0
- pulumi_vault/identity/oidc.py +268 -0
- pulumi_vault/identity/oidc_assignment.py +375 -0
- pulumi_vault/identity/oidc_client.py +667 -0
- pulumi_vault/identity/oidc_key.py +474 -0
- pulumi_vault/identity/oidc_key_allowed_client_id.py +298 -0
- pulumi_vault/identity/oidc_provider.py +550 -0
- pulumi_vault/identity/oidc_role.py +543 -0
- pulumi_vault/identity/oidc_scope.py +355 -0
- pulumi_vault/identity/outputs.py +137 -0
- pulumi_vault/jwt/__init__.py +12 -0
- pulumi_vault/jwt/_inputs.py +225 -0
- pulumi_vault/jwt/auth_backend.py +1347 -0
- pulumi_vault/jwt/auth_backend_role.py +1847 -0
- pulumi_vault/jwt/outputs.py +174 -0
- pulumi_vault/kmip/__init__.py +11 -0
- pulumi_vault/kmip/secret_backend.py +1591 -0
- pulumi_vault/kmip/secret_role.py +1194 -0
- pulumi_vault/kmip/secret_scope.py +372 -0
- pulumi_vault/kubernetes/__init__.py +15 -0
- pulumi_vault/kubernetes/auth_backend_config.py +654 -0
- pulumi_vault/kubernetes/auth_backend_role.py +1031 -0
- pulumi_vault/kubernetes/get_auth_backend_config.py +280 -0
- pulumi_vault/kubernetes/get_auth_backend_role.py +470 -0
- pulumi_vault/kubernetes/get_service_account_token.py +344 -0
- pulumi_vault/kubernetes/secret_backend.py +1341 -0
- pulumi_vault/kubernetes/secret_backend_role.py +1140 -0
- pulumi_vault/kv/__init__.py +18 -0
- pulumi_vault/kv/_inputs.py +124 -0
- pulumi_vault/kv/get_secret.py +240 -0
- pulumi_vault/kv/get_secret_subkeys_v2.py +275 -0
- pulumi_vault/kv/get_secret_v2.py +315 -0
- pulumi_vault/kv/get_secrets_list.py +186 -0
- pulumi_vault/kv/get_secrets_list_v2.py +243 -0
- pulumi_vault/kv/outputs.py +102 -0
- pulumi_vault/kv/secret.py +397 -0
- pulumi_vault/kv/secret_backend_v2.py +455 -0
- pulumi_vault/kv/secret_v2.py +970 -0
- pulumi_vault/ldap/__init__.py +19 -0
- pulumi_vault/ldap/_inputs.py +225 -0
- pulumi_vault/ldap/auth_backend.py +2520 -0
- pulumi_vault/ldap/auth_backend_group.py +386 -0
- pulumi_vault/ldap/auth_backend_user.py +439 -0
- pulumi_vault/ldap/get_dynamic_credentials.py +181 -0
- pulumi_vault/ldap/get_static_credentials.py +192 -0
- pulumi_vault/ldap/outputs.py +174 -0
- pulumi_vault/ldap/secret_backend.py +2207 -0
- pulumi_vault/ldap/secret_backend_dynamic_role.py +767 -0
- pulumi_vault/ldap/secret_backend_library_set.py +552 -0
- pulumi_vault/ldap/secret_backend_static_role.py +541 -0
- pulumi_vault/managed/__init__.py +11 -0
- pulumi_vault/managed/_inputs.py +944 -0
- pulumi_vault/managed/keys.py +398 -0
- pulumi_vault/managed/outputs.py +667 -0
- pulumi_vault/mfa_duo.py +589 -0
- pulumi_vault/mfa_okta.py +623 -0
- pulumi_vault/mfa_pingid.py +670 -0
- pulumi_vault/mfa_totp.py +620 -0
- pulumi_vault/mongodbatlas/__init__.py +10 -0
- pulumi_vault/mongodbatlas/secret_backend.py +388 -0
- pulumi_vault/mongodbatlas/secret_role.py +726 -0
- pulumi_vault/mount.py +1262 -0
- pulumi_vault/namespace.py +452 -0
- pulumi_vault/nomad_secret_backend.py +1559 -0
- pulumi_vault/nomad_secret_role.py +489 -0
- pulumi_vault/oci_auth_backend.py +676 -0
- pulumi_vault/oci_auth_backend_role.py +852 -0
- pulumi_vault/okta/__init__.py +13 -0
- pulumi_vault/okta/_inputs.py +320 -0
- pulumi_vault/okta/auth_backend.py +1231 -0
- pulumi_vault/okta/auth_backend_group.py +369 -0
- pulumi_vault/okta/auth_backend_user.py +416 -0
- pulumi_vault/okta/outputs.py +244 -0
- pulumi_vault/outputs.py +502 -0
- pulumi_vault/pkisecret/__init__.py +38 -0
- pulumi_vault/pkisecret/_inputs.py +270 -0
- pulumi_vault/pkisecret/backend_acme_eab.py +550 -0
- pulumi_vault/pkisecret/backend_config_acme.py +690 -0
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +1370 -0
- pulumi_vault/pkisecret/backend_config_cluster.py +370 -0
- pulumi_vault/pkisecret/backend_config_cmpv2.py +693 -0
- pulumi_vault/pkisecret/backend_config_est.py +756 -0
- pulumi_vault/pkisecret/backend_config_scep.py +738 -0
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +277 -0
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +226 -0
- pulumi_vault/pkisecret/get_backend_config_est.py +251 -0
- pulumi_vault/pkisecret/get_backend_config_scep.py +271 -0
- pulumi_vault/pkisecret/get_backend_issuer.py +395 -0
- pulumi_vault/pkisecret/get_backend_issuers.py +192 -0
- pulumi_vault/pkisecret/get_backend_key.py +211 -0
- pulumi_vault/pkisecret/get_backend_keys.py +192 -0
- pulumi_vault/pkisecret/outputs.py +270 -0
- pulumi_vault/pkisecret/secret_backend_cert.py +1315 -0
- pulumi_vault/pkisecret/secret_backend_config_ca.py +386 -0
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +392 -0
- pulumi_vault/pkisecret/secret_backend_config_urls.py +462 -0
- pulumi_vault/pkisecret/secret_backend_crl_config.py +846 -0
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +1629 -0
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +444 -0
- pulumi_vault/pkisecret/secret_backend_issuer.py +1089 -0
- pulumi_vault/pkisecret/secret_backend_key.py +613 -0
- pulumi_vault/pkisecret/secret_backend_role.py +2694 -0
- pulumi_vault/pkisecret/secret_backend_root_cert.py +2134 -0
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +2031 -0
- pulumi_vault/pkisecret/secret_backend_sign.py +1194 -0
- pulumi_vault/plugin.py +596 -0
- pulumi_vault/plugin_pinned_version.py +299 -0
- pulumi_vault/policy.py +279 -0
- pulumi_vault/provider.py +781 -0
- pulumi_vault/pulumi-plugin.json +5 -0
- pulumi_vault/py.typed +0 -0
- pulumi_vault/quota_lease_count.py +504 -0
- pulumi_vault/quota_rate_limit.py +751 -0
- pulumi_vault/rabbitmq/__init__.py +12 -0
- pulumi_vault/rabbitmq/_inputs.py +235 -0
- pulumi_vault/rabbitmq/outputs.py +144 -0
- pulumi_vault/rabbitmq/secret_backend.py +1437 -0
- pulumi_vault/rabbitmq/secret_backend_role.py +496 -0
- pulumi_vault/raft_autopilot.py +609 -0
- pulumi_vault/raft_snapshot_agent_config.py +1591 -0
- pulumi_vault/rgp_policy.py +349 -0
- pulumi_vault/saml/__init__.py +12 -0
- pulumi_vault/saml/_inputs.py +225 -0
- pulumi_vault/saml/auth_backend.py +811 -0
- pulumi_vault/saml/auth_backend_role.py +1068 -0
- pulumi_vault/saml/outputs.py +174 -0
- pulumi_vault/scep_auth_backend_role.py +908 -0
- pulumi_vault/secrets/__init__.py +18 -0
- pulumi_vault/secrets/_inputs.py +110 -0
- pulumi_vault/secrets/outputs.py +94 -0
- pulumi_vault/secrets/sync_association.py +450 -0
- pulumi_vault/secrets/sync_aws_destination.py +780 -0
- pulumi_vault/secrets/sync_azure_destination.py +736 -0
- pulumi_vault/secrets/sync_config.py +303 -0
- pulumi_vault/secrets/sync_gcp_destination.py +572 -0
- pulumi_vault/secrets/sync_gh_destination.py +688 -0
- pulumi_vault/secrets/sync_github_apps.py +376 -0
- pulumi_vault/secrets/sync_vercel_destination.py +603 -0
- pulumi_vault/ssh/__init__.py +13 -0
- pulumi_vault/ssh/_inputs.py +76 -0
- pulumi_vault/ssh/get_secret_backend_sign.py +294 -0
- pulumi_vault/ssh/outputs.py +51 -0
- pulumi_vault/ssh/secret_backend_ca.py +588 -0
- pulumi_vault/ssh/secret_backend_role.py +1493 -0
- pulumi_vault/terraformcloud/__init__.py +11 -0
- pulumi_vault/terraformcloud/secret_backend.py +1321 -0
- pulumi_vault/terraformcloud/secret_creds.py +445 -0
- pulumi_vault/terraformcloud/secret_role.py +563 -0
- pulumi_vault/token.py +1026 -0
- pulumi_vault/tokenauth/__init__.py +9 -0
- pulumi_vault/tokenauth/auth_backend_role.py +1135 -0
- pulumi_vault/transform/__init__.py +14 -0
- pulumi_vault/transform/alphabet.py +348 -0
- pulumi_vault/transform/get_decode.py +287 -0
- pulumi_vault/transform/get_encode.py +291 -0
- pulumi_vault/transform/role.py +350 -0
- pulumi_vault/transform/template.py +592 -0
- pulumi_vault/transform/transformation.py +608 -0
- pulumi_vault/transit/__init__.py +15 -0
- pulumi_vault/transit/get_cmac.py +256 -0
- pulumi_vault/transit/get_decrypt.py +181 -0
- pulumi_vault/transit/get_encrypt.py +174 -0
- pulumi_vault/transit/get_sign.py +328 -0
- pulumi_vault/transit/get_verify.py +373 -0
- pulumi_vault/transit/secret_backend_key.py +1202 -0
- pulumi_vault/transit/secret_cache_config.py +302 -0
- pulumi_vault-7.6.0a1764657486.dist-info/METADATA +92 -0
- pulumi_vault-7.6.0a1764657486.dist-info/RECORD +274 -0
- pulumi_vault-7.6.0a1764657486.dist-info/WHEEL +5 -0
- pulumi_vault-7.6.0a1764657486.dist-info/top_level.txt +1 -0
|
@@ -0,0 +1,1539 @@
|
|
|
1
|
+
# coding=utf-8
|
|
2
|
+
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
|
+
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
|
+
|
|
5
|
+
import builtins as _builtins
|
|
6
|
+
import warnings
|
|
7
|
+
import sys
|
|
8
|
+
import pulumi
|
|
9
|
+
import pulumi.runtime
|
|
10
|
+
from typing import Any, Mapping, Optional, Sequence, Union, overload
|
|
11
|
+
if sys.version_info >= (3, 11):
|
|
12
|
+
from typing import NotRequired, TypedDict, TypeAlias
|
|
13
|
+
else:
|
|
14
|
+
from typing_extensions import NotRequired, TypedDict, TypeAlias
|
|
15
|
+
from . import _utilities
|
|
16
|
+
|
|
17
|
+
__all__ = ['CertAuthBackendRoleArgs', 'CertAuthBackendRole']
|
|
18
|
+
|
|
19
|
+
@pulumi.input_type
|
|
20
|
+
class CertAuthBackendRoleArgs:
|
|
21
|
+
def __init__(__self__, *,
|
|
22
|
+
certificate: pulumi.Input[_builtins.str],
|
|
23
|
+
alias_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
24
|
+
allowed_common_names: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
25
|
+
allowed_dns_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
26
|
+
allowed_email_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
27
|
+
allowed_names: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
28
|
+
allowed_organizational_units: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
29
|
+
allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
30
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
|
+
display_name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
32
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
33
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
34
|
+
ocsp_ca_certificates: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
|
+
ocsp_enabled: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
36
|
+
ocsp_fail_open: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
37
|
+
ocsp_query_all_servers: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
38
|
+
ocsp_servers_overrides: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
39
|
+
required_extensions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
40
|
+
token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
41
|
+
token_explicit_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
42
|
+
token_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
43
|
+
token_no_default_policy: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
44
|
+
token_num_uses: Optional[pulumi.Input[_builtins.int]] = None,
|
|
45
|
+
token_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
46
|
+
token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
47
|
+
token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
48
|
+
token_type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
49
|
+
"""
|
|
50
|
+
The set of arguments for constructing a CertAuthBackendRole resource.
|
|
51
|
+
:param pulumi.Input[_builtins.str] certificate: CA certificate used to validate client certificates
|
|
52
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] alias_metadata: The metadata to be tied to generated entity alias.
|
|
53
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
54
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_common_names: Allowed the common names for authenticated client certificates
|
|
55
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_dns_sans: Allowed alternative dns names for authenticated client certificates
|
|
56
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_email_sans: Allowed emails for authenticated client certificates
|
|
57
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_names: DEPRECATED: Please use the individual `allowed_X_sans` parameters instead. Allowed subject names for authenticated client certificates
|
|
58
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_organizational_units: Allowed organization units for authenticated client certificates.
|
|
59
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_uri_sans: Allowed URIs for authenticated client certificates
|
|
60
|
+
:param pulumi.Input[_builtins.str] backend: Path to the mounted Cert auth backend
|
|
61
|
+
:param pulumi.Input[_builtins.str] display_name: The name to display on tokens issued under this role.
|
|
62
|
+
:param pulumi.Input[_builtins.str] name: Name of the role
|
|
63
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
64
|
+
The value should not contain leading or trailing forward slashes.
|
|
65
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
66
|
+
*Available only for Vault Enterprise*.
|
|
67
|
+
:param pulumi.Input[_builtins.str] ocsp_ca_certificates: Any additional CA certificates
|
|
68
|
+
needed to verify OCSP responses. Provided as base64 encoded PEM data.
|
|
69
|
+
Requires Vault version 1.13+.
|
|
70
|
+
:param pulumi.Input[_builtins.bool] ocsp_enabled: If enabled, validate certificates'
|
|
71
|
+
revocation status using OCSP. Requires Vault version 1.13+.
|
|
72
|
+
:param pulumi.Input[_builtins.bool] ocsp_fail_open: If true and an OCSP response cannot
|
|
73
|
+
be fetched or is of an unknown status, the login will proceed as if the
|
|
74
|
+
certificate has not been revoked.
|
|
75
|
+
Requires Vault version 1.13+.
|
|
76
|
+
:param pulumi.Input[_builtins.bool] ocsp_query_all_servers: If set to true, rather than
|
|
77
|
+
accepting the first successful OCSP response, query all servers and consider
|
|
78
|
+
the certificate valid only if all servers agree.
|
|
79
|
+
Requires Vault version 1.13+.
|
|
80
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] ocsp_servers_overrides: : A comma-separated list of OCSP
|
|
81
|
+
server addresses. If unset, the OCSP server is determined from the
|
|
82
|
+
AuthorityInformationAccess extension on the certificate being inspected.
|
|
83
|
+
Requires Vault version 1.13+.
|
|
84
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] required_extensions: TLS extensions required on
|
|
85
|
+
client certificates
|
|
86
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
87
|
+
:param pulumi.Input[_builtins.int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
|
|
88
|
+
:param pulumi.Input[_builtins.int] token_max_ttl: The maximum lifetime of the generated token
|
|
89
|
+
:param pulumi.Input[_builtins.bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
|
|
90
|
+
:param pulumi.Input[_builtins.int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
|
|
91
|
+
:param pulumi.Input[_builtins.int] token_period: Generated Token's Period
|
|
92
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_policies: Generated Token's Policies
|
|
93
|
+
:param pulumi.Input[_builtins.int] token_ttl: The initial ttl of the token to generate in seconds
|
|
94
|
+
:param pulumi.Input[_builtins.str] token_type: The type of token to generate, service or batch
|
|
95
|
+
"""
|
|
96
|
+
pulumi.set(__self__, "certificate", certificate)
|
|
97
|
+
if alias_metadata is not None:
|
|
98
|
+
pulumi.set(__self__, "alias_metadata", alias_metadata)
|
|
99
|
+
if allowed_common_names is not None:
|
|
100
|
+
pulumi.set(__self__, "allowed_common_names", allowed_common_names)
|
|
101
|
+
if allowed_dns_sans is not None:
|
|
102
|
+
pulumi.set(__self__, "allowed_dns_sans", allowed_dns_sans)
|
|
103
|
+
if allowed_email_sans is not None:
|
|
104
|
+
pulumi.set(__self__, "allowed_email_sans", allowed_email_sans)
|
|
105
|
+
if allowed_names is not None:
|
|
106
|
+
pulumi.set(__self__, "allowed_names", allowed_names)
|
|
107
|
+
if allowed_organizational_units is not None:
|
|
108
|
+
pulumi.set(__self__, "allowed_organizational_units", allowed_organizational_units)
|
|
109
|
+
if allowed_uri_sans is not None:
|
|
110
|
+
pulumi.set(__self__, "allowed_uri_sans", allowed_uri_sans)
|
|
111
|
+
if backend is not None:
|
|
112
|
+
pulumi.set(__self__, "backend", backend)
|
|
113
|
+
if display_name is not None:
|
|
114
|
+
pulumi.set(__self__, "display_name", display_name)
|
|
115
|
+
if name is not None:
|
|
116
|
+
pulumi.set(__self__, "name", name)
|
|
117
|
+
if namespace is not None:
|
|
118
|
+
pulumi.set(__self__, "namespace", namespace)
|
|
119
|
+
if ocsp_ca_certificates is not None:
|
|
120
|
+
pulumi.set(__self__, "ocsp_ca_certificates", ocsp_ca_certificates)
|
|
121
|
+
if ocsp_enabled is not None:
|
|
122
|
+
pulumi.set(__self__, "ocsp_enabled", ocsp_enabled)
|
|
123
|
+
if ocsp_fail_open is not None:
|
|
124
|
+
pulumi.set(__self__, "ocsp_fail_open", ocsp_fail_open)
|
|
125
|
+
if ocsp_query_all_servers is not None:
|
|
126
|
+
pulumi.set(__self__, "ocsp_query_all_servers", ocsp_query_all_servers)
|
|
127
|
+
if ocsp_servers_overrides is not None:
|
|
128
|
+
pulumi.set(__self__, "ocsp_servers_overrides", ocsp_servers_overrides)
|
|
129
|
+
if required_extensions is not None:
|
|
130
|
+
pulumi.set(__self__, "required_extensions", required_extensions)
|
|
131
|
+
if token_bound_cidrs is not None:
|
|
132
|
+
pulumi.set(__self__, "token_bound_cidrs", token_bound_cidrs)
|
|
133
|
+
if token_explicit_max_ttl is not None:
|
|
134
|
+
pulumi.set(__self__, "token_explicit_max_ttl", token_explicit_max_ttl)
|
|
135
|
+
if token_max_ttl is not None:
|
|
136
|
+
pulumi.set(__self__, "token_max_ttl", token_max_ttl)
|
|
137
|
+
if token_no_default_policy is not None:
|
|
138
|
+
pulumi.set(__self__, "token_no_default_policy", token_no_default_policy)
|
|
139
|
+
if token_num_uses is not None:
|
|
140
|
+
pulumi.set(__self__, "token_num_uses", token_num_uses)
|
|
141
|
+
if token_period is not None:
|
|
142
|
+
pulumi.set(__self__, "token_period", token_period)
|
|
143
|
+
if token_policies is not None:
|
|
144
|
+
pulumi.set(__self__, "token_policies", token_policies)
|
|
145
|
+
if token_ttl is not None:
|
|
146
|
+
pulumi.set(__self__, "token_ttl", token_ttl)
|
|
147
|
+
if token_type is not None:
|
|
148
|
+
pulumi.set(__self__, "token_type", token_type)
|
|
149
|
+
|
|
150
|
+
@_builtins.property
|
|
151
|
+
@pulumi.getter
|
|
152
|
+
def certificate(self) -> pulumi.Input[_builtins.str]:
|
|
153
|
+
"""
|
|
154
|
+
CA certificate used to validate client certificates
|
|
155
|
+
"""
|
|
156
|
+
return pulumi.get(self, "certificate")
|
|
157
|
+
|
|
158
|
+
@certificate.setter
|
|
159
|
+
def certificate(self, value: pulumi.Input[_builtins.str]):
|
|
160
|
+
pulumi.set(self, "certificate", value)
|
|
161
|
+
|
|
162
|
+
@_builtins.property
|
|
163
|
+
@pulumi.getter(name="aliasMetadata")
|
|
164
|
+
def alias_metadata(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
165
|
+
"""
|
|
166
|
+
The metadata to be tied to generated entity alias.
|
|
167
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
168
|
+
"""
|
|
169
|
+
return pulumi.get(self, "alias_metadata")
|
|
170
|
+
|
|
171
|
+
@alias_metadata.setter
|
|
172
|
+
def alias_metadata(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
173
|
+
pulumi.set(self, "alias_metadata", value)
|
|
174
|
+
|
|
175
|
+
@_builtins.property
|
|
176
|
+
@pulumi.getter(name="allowedCommonNames")
|
|
177
|
+
def allowed_common_names(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
178
|
+
"""
|
|
179
|
+
Allowed the common names for authenticated client certificates
|
|
180
|
+
"""
|
|
181
|
+
return pulumi.get(self, "allowed_common_names")
|
|
182
|
+
|
|
183
|
+
@allowed_common_names.setter
|
|
184
|
+
def allowed_common_names(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
185
|
+
pulumi.set(self, "allowed_common_names", value)
|
|
186
|
+
|
|
187
|
+
@_builtins.property
|
|
188
|
+
@pulumi.getter(name="allowedDnsSans")
|
|
189
|
+
def allowed_dns_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
190
|
+
"""
|
|
191
|
+
Allowed alternative dns names for authenticated client certificates
|
|
192
|
+
"""
|
|
193
|
+
return pulumi.get(self, "allowed_dns_sans")
|
|
194
|
+
|
|
195
|
+
@allowed_dns_sans.setter
|
|
196
|
+
def allowed_dns_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
197
|
+
pulumi.set(self, "allowed_dns_sans", value)
|
|
198
|
+
|
|
199
|
+
@_builtins.property
|
|
200
|
+
@pulumi.getter(name="allowedEmailSans")
|
|
201
|
+
def allowed_email_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
202
|
+
"""
|
|
203
|
+
Allowed emails for authenticated client certificates
|
|
204
|
+
"""
|
|
205
|
+
return pulumi.get(self, "allowed_email_sans")
|
|
206
|
+
|
|
207
|
+
@allowed_email_sans.setter
|
|
208
|
+
def allowed_email_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
209
|
+
pulumi.set(self, "allowed_email_sans", value)
|
|
210
|
+
|
|
211
|
+
@_builtins.property
|
|
212
|
+
@pulumi.getter(name="allowedNames")
|
|
213
|
+
def allowed_names(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
214
|
+
"""
|
|
215
|
+
DEPRECATED: Please use the individual `allowed_X_sans` parameters instead. Allowed subject names for authenticated client certificates
|
|
216
|
+
"""
|
|
217
|
+
return pulumi.get(self, "allowed_names")
|
|
218
|
+
|
|
219
|
+
@allowed_names.setter
|
|
220
|
+
def allowed_names(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
221
|
+
pulumi.set(self, "allowed_names", value)
|
|
222
|
+
|
|
223
|
+
@_builtins.property
|
|
224
|
+
@pulumi.getter(name="allowedOrganizationalUnits")
|
|
225
|
+
def allowed_organizational_units(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
226
|
+
"""
|
|
227
|
+
Allowed organization units for authenticated client certificates.
|
|
228
|
+
"""
|
|
229
|
+
return pulumi.get(self, "allowed_organizational_units")
|
|
230
|
+
|
|
231
|
+
@allowed_organizational_units.setter
|
|
232
|
+
def allowed_organizational_units(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
233
|
+
pulumi.set(self, "allowed_organizational_units", value)
|
|
234
|
+
|
|
235
|
+
@_builtins.property
|
|
236
|
+
@pulumi.getter(name="allowedUriSans")
|
|
237
|
+
def allowed_uri_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
238
|
+
"""
|
|
239
|
+
Allowed URIs for authenticated client certificates
|
|
240
|
+
"""
|
|
241
|
+
return pulumi.get(self, "allowed_uri_sans")
|
|
242
|
+
|
|
243
|
+
@allowed_uri_sans.setter
|
|
244
|
+
def allowed_uri_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
245
|
+
pulumi.set(self, "allowed_uri_sans", value)
|
|
246
|
+
|
|
247
|
+
@_builtins.property
|
|
248
|
+
@pulumi.getter
|
|
249
|
+
def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
250
|
+
"""
|
|
251
|
+
Path to the mounted Cert auth backend
|
|
252
|
+
"""
|
|
253
|
+
return pulumi.get(self, "backend")
|
|
254
|
+
|
|
255
|
+
@backend.setter
|
|
256
|
+
def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
257
|
+
pulumi.set(self, "backend", value)
|
|
258
|
+
|
|
259
|
+
@_builtins.property
|
|
260
|
+
@pulumi.getter(name="displayName")
|
|
261
|
+
def display_name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
262
|
+
"""
|
|
263
|
+
The name to display on tokens issued under this role.
|
|
264
|
+
"""
|
|
265
|
+
return pulumi.get(self, "display_name")
|
|
266
|
+
|
|
267
|
+
@display_name.setter
|
|
268
|
+
def display_name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
269
|
+
pulumi.set(self, "display_name", value)
|
|
270
|
+
|
|
271
|
+
@_builtins.property
|
|
272
|
+
@pulumi.getter
|
|
273
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
274
|
+
"""
|
|
275
|
+
Name of the role
|
|
276
|
+
"""
|
|
277
|
+
return pulumi.get(self, "name")
|
|
278
|
+
|
|
279
|
+
@name.setter
|
|
280
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
281
|
+
pulumi.set(self, "name", value)
|
|
282
|
+
|
|
283
|
+
@_builtins.property
|
|
284
|
+
@pulumi.getter
|
|
285
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
286
|
+
"""
|
|
287
|
+
The namespace to provision the resource in.
|
|
288
|
+
The value should not contain leading or trailing forward slashes.
|
|
289
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
290
|
+
*Available only for Vault Enterprise*.
|
|
291
|
+
"""
|
|
292
|
+
return pulumi.get(self, "namespace")
|
|
293
|
+
|
|
294
|
+
@namespace.setter
|
|
295
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
296
|
+
pulumi.set(self, "namespace", value)
|
|
297
|
+
|
|
298
|
+
@_builtins.property
|
|
299
|
+
@pulumi.getter(name="ocspCaCertificates")
|
|
300
|
+
def ocsp_ca_certificates(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
301
|
+
"""
|
|
302
|
+
Any additional CA certificates
|
|
303
|
+
needed to verify OCSP responses. Provided as base64 encoded PEM data.
|
|
304
|
+
Requires Vault version 1.13+.
|
|
305
|
+
"""
|
|
306
|
+
return pulumi.get(self, "ocsp_ca_certificates")
|
|
307
|
+
|
|
308
|
+
@ocsp_ca_certificates.setter
|
|
309
|
+
def ocsp_ca_certificates(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
310
|
+
pulumi.set(self, "ocsp_ca_certificates", value)
|
|
311
|
+
|
|
312
|
+
@_builtins.property
|
|
313
|
+
@pulumi.getter(name="ocspEnabled")
|
|
314
|
+
def ocsp_enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
315
|
+
"""
|
|
316
|
+
If enabled, validate certificates'
|
|
317
|
+
revocation status using OCSP. Requires Vault version 1.13+.
|
|
318
|
+
"""
|
|
319
|
+
return pulumi.get(self, "ocsp_enabled")
|
|
320
|
+
|
|
321
|
+
@ocsp_enabled.setter
|
|
322
|
+
def ocsp_enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
323
|
+
pulumi.set(self, "ocsp_enabled", value)
|
|
324
|
+
|
|
325
|
+
@_builtins.property
|
|
326
|
+
@pulumi.getter(name="ocspFailOpen")
|
|
327
|
+
def ocsp_fail_open(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
328
|
+
"""
|
|
329
|
+
If true and an OCSP response cannot
|
|
330
|
+
be fetched or is of an unknown status, the login will proceed as if the
|
|
331
|
+
certificate has not been revoked.
|
|
332
|
+
Requires Vault version 1.13+.
|
|
333
|
+
"""
|
|
334
|
+
return pulumi.get(self, "ocsp_fail_open")
|
|
335
|
+
|
|
336
|
+
@ocsp_fail_open.setter
|
|
337
|
+
def ocsp_fail_open(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
338
|
+
pulumi.set(self, "ocsp_fail_open", value)
|
|
339
|
+
|
|
340
|
+
@_builtins.property
|
|
341
|
+
@pulumi.getter(name="ocspQueryAllServers")
|
|
342
|
+
def ocsp_query_all_servers(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
343
|
+
"""
|
|
344
|
+
If set to true, rather than
|
|
345
|
+
accepting the first successful OCSP response, query all servers and consider
|
|
346
|
+
the certificate valid only if all servers agree.
|
|
347
|
+
Requires Vault version 1.13+.
|
|
348
|
+
"""
|
|
349
|
+
return pulumi.get(self, "ocsp_query_all_servers")
|
|
350
|
+
|
|
351
|
+
@ocsp_query_all_servers.setter
|
|
352
|
+
def ocsp_query_all_servers(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
353
|
+
pulumi.set(self, "ocsp_query_all_servers", value)
|
|
354
|
+
|
|
355
|
+
@_builtins.property
|
|
356
|
+
@pulumi.getter(name="ocspServersOverrides")
|
|
357
|
+
def ocsp_servers_overrides(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
358
|
+
"""
|
|
359
|
+
: A comma-separated list of OCSP
|
|
360
|
+
server addresses. If unset, the OCSP server is determined from the
|
|
361
|
+
AuthorityInformationAccess extension on the certificate being inspected.
|
|
362
|
+
Requires Vault version 1.13+.
|
|
363
|
+
"""
|
|
364
|
+
return pulumi.get(self, "ocsp_servers_overrides")
|
|
365
|
+
|
|
366
|
+
@ocsp_servers_overrides.setter
|
|
367
|
+
def ocsp_servers_overrides(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
368
|
+
pulumi.set(self, "ocsp_servers_overrides", value)
|
|
369
|
+
|
|
370
|
+
@_builtins.property
|
|
371
|
+
@pulumi.getter(name="requiredExtensions")
|
|
372
|
+
def required_extensions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
373
|
+
"""
|
|
374
|
+
TLS extensions required on
|
|
375
|
+
client certificates
|
|
376
|
+
"""
|
|
377
|
+
return pulumi.get(self, "required_extensions")
|
|
378
|
+
|
|
379
|
+
@required_extensions.setter
|
|
380
|
+
def required_extensions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
381
|
+
pulumi.set(self, "required_extensions", value)
|
|
382
|
+
|
|
383
|
+
@_builtins.property
|
|
384
|
+
@pulumi.getter(name="tokenBoundCidrs")
|
|
385
|
+
def token_bound_cidrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
386
|
+
"""
|
|
387
|
+
Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
388
|
+
"""
|
|
389
|
+
return pulumi.get(self, "token_bound_cidrs")
|
|
390
|
+
|
|
391
|
+
@token_bound_cidrs.setter
|
|
392
|
+
def token_bound_cidrs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
393
|
+
pulumi.set(self, "token_bound_cidrs", value)
|
|
394
|
+
|
|
395
|
+
@_builtins.property
|
|
396
|
+
@pulumi.getter(name="tokenExplicitMaxTtl")
|
|
397
|
+
def token_explicit_max_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
398
|
+
"""
|
|
399
|
+
Generated Token's Explicit Maximum TTL in seconds
|
|
400
|
+
"""
|
|
401
|
+
return pulumi.get(self, "token_explicit_max_ttl")
|
|
402
|
+
|
|
403
|
+
@token_explicit_max_ttl.setter
|
|
404
|
+
def token_explicit_max_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
405
|
+
pulumi.set(self, "token_explicit_max_ttl", value)
|
|
406
|
+
|
|
407
|
+
@_builtins.property
|
|
408
|
+
@pulumi.getter(name="tokenMaxTtl")
|
|
409
|
+
def token_max_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
410
|
+
"""
|
|
411
|
+
The maximum lifetime of the generated token
|
|
412
|
+
"""
|
|
413
|
+
return pulumi.get(self, "token_max_ttl")
|
|
414
|
+
|
|
415
|
+
@token_max_ttl.setter
|
|
416
|
+
def token_max_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
417
|
+
pulumi.set(self, "token_max_ttl", value)
|
|
418
|
+
|
|
419
|
+
@_builtins.property
|
|
420
|
+
@pulumi.getter(name="tokenNoDefaultPolicy")
|
|
421
|
+
def token_no_default_policy(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
422
|
+
"""
|
|
423
|
+
If true, the 'default' policy will not automatically be added to generated tokens
|
|
424
|
+
"""
|
|
425
|
+
return pulumi.get(self, "token_no_default_policy")
|
|
426
|
+
|
|
427
|
+
@token_no_default_policy.setter
|
|
428
|
+
def token_no_default_policy(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
429
|
+
pulumi.set(self, "token_no_default_policy", value)
|
|
430
|
+
|
|
431
|
+
@_builtins.property
|
|
432
|
+
@pulumi.getter(name="tokenNumUses")
|
|
433
|
+
def token_num_uses(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
434
|
+
"""
|
|
435
|
+
The maximum number of times a token may be used, a value of zero means unlimited
|
|
436
|
+
"""
|
|
437
|
+
return pulumi.get(self, "token_num_uses")
|
|
438
|
+
|
|
439
|
+
@token_num_uses.setter
|
|
440
|
+
def token_num_uses(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
441
|
+
pulumi.set(self, "token_num_uses", value)
|
|
442
|
+
|
|
443
|
+
@_builtins.property
|
|
444
|
+
@pulumi.getter(name="tokenPeriod")
|
|
445
|
+
def token_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
446
|
+
"""
|
|
447
|
+
Generated Token's Period
|
|
448
|
+
"""
|
|
449
|
+
return pulumi.get(self, "token_period")
|
|
450
|
+
|
|
451
|
+
@token_period.setter
|
|
452
|
+
def token_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
453
|
+
pulumi.set(self, "token_period", value)
|
|
454
|
+
|
|
455
|
+
@_builtins.property
|
|
456
|
+
@pulumi.getter(name="tokenPolicies")
|
|
457
|
+
def token_policies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
458
|
+
"""
|
|
459
|
+
Generated Token's Policies
|
|
460
|
+
"""
|
|
461
|
+
return pulumi.get(self, "token_policies")
|
|
462
|
+
|
|
463
|
+
@token_policies.setter
|
|
464
|
+
def token_policies(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
465
|
+
pulumi.set(self, "token_policies", value)
|
|
466
|
+
|
|
467
|
+
@_builtins.property
|
|
468
|
+
@pulumi.getter(name="tokenTtl")
|
|
469
|
+
def token_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
470
|
+
"""
|
|
471
|
+
The initial ttl of the token to generate in seconds
|
|
472
|
+
"""
|
|
473
|
+
return pulumi.get(self, "token_ttl")
|
|
474
|
+
|
|
475
|
+
@token_ttl.setter
|
|
476
|
+
def token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
477
|
+
pulumi.set(self, "token_ttl", value)
|
|
478
|
+
|
|
479
|
+
@_builtins.property
|
|
480
|
+
@pulumi.getter(name="tokenType")
|
|
481
|
+
def token_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
482
|
+
"""
|
|
483
|
+
The type of token to generate, service or batch
|
|
484
|
+
"""
|
|
485
|
+
return pulumi.get(self, "token_type")
|
|
486
|
+
|
|
487
|
+
@token_type.setter
|
|
488
|
+
def token_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
489
|
+
pulumi.set(self, "token_type", value)
|
|
490
|
+
|
|
491
|
+
|
|
492
|
+
@pulumi.input_type
|
|
493
|
+
class _CertAuthBackendRoleState:
|
|
494
|
+
def __init__(__self__, *,
|
|
495
|
+
alias_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
496
|
+
allowed_common_names: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
497
|
+
allowed_dns_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
498
|
+
allowed_email_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
499
|
+
allowed_names: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
500
|
+
allowed_organizational_units: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
501
|
+
allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
502
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
503
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
504
|
+
display_name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
505
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
506
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
507
|
+
ocsp_ca_certificates: Optional[pulumi.Input[_builtins.str]] = None,
|
|
508
|
+
ocsp_enabled: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
509
|
+
ocsp_fail_open: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
510
|
+
ocsp_query_all_servers: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
511
|
+
ocsp_servers_overrides: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
512
|
+
required_extensions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
513
|
+
token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
514
|
+
token_explicit_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
515
|
+
token_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
516
|
+
token_no_default_policy: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
517
|
+
token_num_uses: Optional[pulumi.Input[_builtins.int]] = None,
|
|
518
|
+
token_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
519
|
+
token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
520
|
+
token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
521
|
+
token_type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
522
|
+
"""
|
|
523
|
+
Input properties used for looking up and filtering CertAuthBackendRole resources.
|
|
524
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] alias_metadata: The metadata to be tied to generated entity alias.
|
|
525
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
526
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_common_names: Allowed the common names for authenticated client certificates
|
|
527
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_dns_sans: Allowed alternative dns names for authenticated client certificates
|
|
528
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_email_sans: Allowed emails for authenticated client certificates
|
|
529
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_names: DEPRECATED: Please use the individual `allowed_X_sans` parameters instead. Allowed subject names for authenticated client certificates
|
|
530
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_organizational_units: Allowed organization units for authenticated client certificates.
|
|
531
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_uri_sans: Allowed URIs for authenticated client certificates
|
|
532
|
+
:param pulumi.Input[_builtins.str] backend: Path to the mounted Cert auth backend
|
|
533
|
+
:param pulumi.Input[_builtins.str] certificate: CA certificate used to validate client certificates
|
|
534
|
+
:param pulumi.Input[_builtins.str] display_name: The name to display on tokens issued under this role.
|
|
535
|
+
:param pulumi.Input[_builtins.str] name: Name of the role
|
|
536
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
537
|
+
The value should not contain leading or trailing forward slashes.
|
|
538
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
539
|
+
*Available only for Vault Enterprise*.
|
|
540
|
+
:param pulumi.Input[_builtins.str] ocsp_ca_certificates: Any additional CA certificates
|
|
541
|
+
needed to verify OCSP responses. Provided as base64 encoded PEM data.
|
|
542
|
+
Requires Vault version 1.13+.
|
|
543
|
+
:param pulumi.Input[_builtins.bool] ocsp_enabled: If enabled, validate certificates'
|
|
544
|
+
revocation status using OCSP. Requires Vault version 1.13+.
|
|
545
|
+
:param pulumi.Input[_builtins.bool] ocsp_fail_open: If true and an OCSP response cannot
|
|
546
|
+
be fetched or is of an unknown status, the login will proceed as if the
|
|
547
|
+
certificate has not been revoked.
|
|
548
|
+
Requires Vault version 1.13+.
|
|
549
|
+
:param pulumi.Input[_builtins.bool] ocsp_query_all_servers: If set to true, rather than
|
|
550
|
+
accepting the first successful OCSP response, query all servers and consider
|
|
551
|
+
the certificate valid only if all servers agree.
|
|
552
|
+
Requires Vault version 1.13+.
|
|
553
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] ocsp_servers_overrides: : A comma-separated list of OCSP
|
|
554
|
+
server addresses. If unset, the OCSP server is determined from the
|
|
555
|
+
AuthorityInformationAccess extension on the certificate being inspected.
|
|
556
|
+
Requires Vault version 1.13+.
|
|
557
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] required_extensions: TLS extensions required on
|
|
558
|
+
client certificates
|
|
559
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
560
|
+
:param pulumi.Input[_builtins.int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
|
|
561
|
+
:param pulumi.Input[_builtins.int] token_max_ttl: The maximum lifetime of the generated token
|
|
562
|
+
:param pulumi.Input[_builtins.bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
|
|
563
|
+
:param pulumi.Input[_builtins.int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
|
|
564
|
+
:param pulumi.Input[_builtins.int] token_period: Generated Token's Period
|
|
565
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_policies: Generated Token's Policies
|
|
566
|
+
:param pulumi.Input[_builtins.int] token_ttl: The initial ttl of the token to generate in seconds
|
|
567
|
+
:param pulumi.Input[_builtins.str] token_type: The type of token to generate, service or batch
|
|
568
|
+
"""
|
|
569
|
+
if alias_metadata is not None:
|
|
570
|
+
pulumi.set(__self__, "alias_metadata", alias_metadata)
|
|
571
|
+
if allowed_common_names is not None:
|
|
572
|
+
pulumi.set(__self__, "allowed_common_names", allowed_common_names)
|
|
573
|
+
if allowed_dns_sans is not None:
|
|
574
|
+
pulumi.set(__self__, "allowed_dns_sans", allowed_dns_sans)
|
|
575
|
+
if allowed_email_sans is not None:
|
|
576
|
+
pulumi.set(__self__, "allowed_email_sans", allowed_email_sans)
|
|
577
|
+
if allowed_names is not None:
|
|
578
|
+
pulumi.set(__self__, "allowed_names", allowed_names)
|
|
579
|
+
if allowed_organizational_units is not None:
|
|
580
|
+
pulumi.set(__self__, "allowed_organizational_units", allowed_organizational_units)
|
|
581
|
+
if allowed_uri_sans is not None:
|
|
582
|
+
pulumi.set(__self__, "allowed_uri_sans", allowed_uri_sans)
|
|
583
|
+
if backend is not None:
|
|
584
|
+
pulumi.set(__self__, "backend", backend)
|
|
585
|
+
if certificate is not None:
|
|
586
|
+
pulumi.set(__self__, "certificate", certificate)
|
|
587
|
+
if display_name is not None:
|
|
588
|
+
pulumi.set(__self__, "display_name", display_name)
|
|
589
|
+
if name is not None:
|
|
590
|
+
pulumi.set(__self__, "name", name)
|
|
591
|
+
if namespace is not None:
|
|
592
|
+
pulumi.set(__self__, "namespace", namespace)
|
|
593
|
+
if ocsp_ca_certificates is not None:
|
|
594
|
+
pulumi.set(__self__, "ocsp_ca_certificates", ocsp_ca_certificates)
|
|
595
|
+
if ocsp_enabled is not None:
|
|
596
|
+
pulumi.set(__self__, "ocsp_enabled", ocsp_enabled)
|
|
597
|
+
if ocsp_fail_open is not None:
|
|
598
|
+
pulumi.set(__self__, "ocsp_fail_open", ocsp_fail_open)
|
|
599
|
+
if ocsp_query_all_servers is not None:
|
|
600
|
+
pulumi.set(__self__, "ocsp_query_all_servers", ocsp_query_all_servers)
|
|
601
|
+
if ocsp_servers_overrides is not None:
|
|
602
|
+
pulumi.set(__self__, "ocsp_servers_overrides", ocsp_servers_overrides)
|
|
603
|
+
if required_extensions is not None:
|
|
604
|
+
pulumi.set(__self__, "required_extensions", required_extensions)
|
|
605
|
+
if token_bound_cidrs is not None:
|
|
606
|
+
pulumi.set(__self__, "token_bound_cidrs", token_bound_cidrs)
|
|
607
|
+
if token_explicit_max_ttl is not None:
|
|
608
|
+
pulumi.set(__self__, "token_explicit_max_ttl", token_explicit_max_ttl)
|
|
609
|
+
if token_max_ttl is not None:
|
|
610
|
+
pulumi.set(__self__, "token_max_ttl", token_max_ttl)
|
|
611
|
+
if token_no_default_policy is not None:
|
|
612
|
+
pulumi.set(__self__, "token_no_default_policy", token_no_default_policy)
|
|
613
|
+
if token_num_uses is not None:
|
|
614
|
+
pulumi.set(__self__, "token_num_uses", token_num_uses)
|
|
615
|
+
if token_period is not None:
|
|
616
|
+
pulumi.set(__self__, "token_period", token_period)
|
|
617
|
+
if token_policies is not None:
|
|
618
|
+
pulumi.set(__self__, "token_policies", token_policies)
|
|
619
|
+
if token_ttl is not None:
|
|
620
|
+
pulumi.set(__self__, "token_ttl", token_ttl)
|
|
621
|
+
if token_type is not None:
|
|
622
|
+
pulumi.set(__self__, "token_type", token_type)
|
|
623
|
+
|
|
624
|
+
@_builtins.property
|
|
625
|
+
@pulumi.getter(name="aliasMetadata")
|
|
626
|
+
def alias_metadata(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
627
|
+
"""
|
|
628
|
+
The metadata to be tied to generated entity alias.
|
|
629
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
630
|
+
"""
|
|
631
|
+
return pulumi.get(self, "alias_metadata")
|
|
632
|
+
|
|
633
|
+
@alias_metadata.setter
|
|
634
|
+
def alias_metadata(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
635
|
+
pulumi.set(self, "alias_metadata", value)
|
|
636
|
+
|
|
637
|
+
@_builtins.property
|
|
638
|
+
@pulumi.getter(name="allowedCommonNames")
|
|
639
|
+
def allowed_common_names(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
640
|
+
"""
|
|
641
|
+
Allowed the common names for authenticated client certificates
|
|
642
|
+
"""
|
|
643
|
+
return pulumi.get(self, "allowed_common_names")
|
|
644
|
+
|
|
645
|
+
@allowed_common_names.setter
|
|
646
|
+
def allowed_common_names(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
647
|
+
pulumi.set(self, "allowed_common_names", value)
|
|
648
|
+
|
|
649
|
+
@_builtins.property
|
|
650
|
+
@pulumi.getter(name="allowedDnsSans")
|
|
651
|
+
def allowed_dns_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
652
|
+
"""
|
|
653
|
+
Allowed alternative dns names for authenticated client certificates
|
|
654
|
+
"""
|
|
655
|
+
return pulumi.get(self, "allowed_dns_sans")
|
|
656
|
+
|
|
657
|
+
@allowed_dns_sans.setter
|
|
658
|
+
def allowed_dns_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
659
|
+
pulumi.set(self, "allowed_dns_sans", value)
|
|
660
|
+
|
|
661
|
+
@_builtins.property
|
|
662
|
+
@pulumi.getter(name="allowedEmailSans")
|
|
663
|
+
def allowed_email_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
664
|
+
"""
|
|
665
|
+
Allowed emails for authenticated client certificates
|
|
666
|
+
"""
|
|
667
|
+
return pulumi.get(self, "allowed_email_sans")
|
|
668
|
+
|
|
669
|
+
@allowed_email_sans.setter
|
|
670
|
+
def allowed_email_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
671
|
+
pulumi.set(self, "allowed_email_sans", value)
|
|
672
|
+
|
|
673
|
+
@_builtins.property
|
|
674
|
+
@pulumi.getter(name="allowedNames")
|
|
675
|
+
def allowed_names(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
676
|
+
"""
|
|
677
|
+
DEPRECATED: Please use the individual `allowed_X_sans` parameters instead. Allowed subject names for authenticated client certificates
|
|
678
|
+
"""
|
|
679
|
+
return pulumi.get(self, "allowed_names")
|
|
680
|
+
|
|
681
|
+
@allowed_names.setter
|
|
682
|
+
def allowed_names(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
683
|
+
pulumi.set(self, "allowed_names", value)
|
|
684
|
+
|
|
685
|
+
@_builtins.property
|
|
686
|
+
@pulumi.getter(name="allowedOrganizationalUnits")
|
|
687
|
+
def allowed_organizational_units(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
688
|
+
"""
|
|
689
|
+
Allowed organization units for authenticated client certificates.
|
|
690
|
+
"""
|
|
691
|
+
return pulumi.get(self, "allowed_organizational_units")
|
|
692
|
+
|
|
693
|
+
@allowed_organizational_units.setter
|
|
694
|
+
def allowed_organizational_units(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
695
|
+
pulumi.set(self, "allowed_organizational_units", value)
|
|
696
|
+
|
|
697
|
+
@_builtins.property
|
|
698
|
+
@pulumi.getter(name="allowedUriSans")
|
|
699
|
+
def allowed_uri_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
700
|
+
"""
|
|
701
|
+
Allowed URIs for authenticated client certificates
|
|
702
|
+
"""
|
|
703
|
+
return pulumi.get(self, "allowed_uri_sans")
|
|
704
|
+
|
|
705
|
+
@allowed_uri_sans.setter
|
|
706
|
+
def allowed_uri_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
707
|
+
pulumi.set(self, "allowed_uri_sans", value)
|
|
708
|
+
|
|
709
|
+
@_builtins.property
|
|
710
|
+
@pulumi.getter
|
|
711
|
+
def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
712
|
+
"""
|
|
713
|
+
Path to the mounted Cert auth backend
|
|
714
|
+
"""
|
|
715
|
+
return pulumi.get(self, "backend")
|
|
716
|
+
|
|
717
|
+
@backend.setter
|
|
718
|
+
def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
719
|
+
pulumi.set(self, "backend", value)
|
|
720
|
+
|
|
721
|
+
@_builtins.property
|
|
722
|
+
@pulumi.getter
|
|
723
|
+
def certificate(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
724
|
+
"""
|
|
725
|
+
CA certificate used to validate client certificates
|
|
726
|
+
"""
|
|
727
|
+
return pulumi.get(self, "certificate")
|
|
728
|
+
|
|
729
|
+
@certificate.setter
|
|
730
|
+
def certificate(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
731
|
+
pulumi.set(self, "certificate", value)
|
|
732
|
+
|
|
733
|
+
@_builtins.property
|
|
734
|
+
@pulumi.getter(name="displayName")
|
|
735
|
+
def display_name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
736
|
+
"""
|
|
737
|
+
The name to display on tokens issued under this role.
|
|
738
|
+
"""
|
|
739
|
+
return pulumi.get(self, "display_name")
|
|
740
|
+
|
|
741
|
+
@display_name.setter
|
|
742
|
+
def display_name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
743
|
+
pulumi.set(self, "display_name", value)
|
|
744
|
+
|
|
745
|
+
@_builtins.property
|
|
746
|
+
@pulumi.getter
|
|
747
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
748
|
+
"""
|
|
749
|
+
Name of the role
|
|
750
|
+
"""
|
|
751
|
+
return pulumi.get(self, "name")
|
|
752
|
+
|
|
753
|
+
@name.setter
|
|
754
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
755
|
+
pulumi.set(self, "name", value)
|
|
756
|
+
|
|
757
|
+
@_builtins.property
|
|
758
|
+
@pulumi.getter
|
|
759
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
760
|
+
"""
|
|
761
|
+
The namespace to provision the resource in.
|
|
762
|
+
The value should not contain leading or trailing forward slashes.
|
|
763
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
764
|
+
*Available only for Vault Enterprise*.
|
|
765
|
+
"""
|
|
766
|
+
return pulumi.get(self, "namespace")
|
|
767
|
+
|
|
768
|
+
@namespace.setter
|
|
769
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
770
|
+
pulumi.set(self, "namespace", value)
|
|
771
|
+
|
|
772
|
+
@_builtins.property
|
|
773
|
+
@pulumi.getter(name="ocspCaCertificates")
|
|
774
|
+
def ocsp_ca_certificates(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
775
|
+
"""
|
|
776
|
+
Any additional CA certificates
|
|
777
|
+
needed to verify OCSP responses. Provided as base64 encoded PEM data.
|
|
778
|
+
Requires Vault version 1.13+.
|
|
779
|
+
"""
|
|
780
|
+
return pulumi.get(self, "ocsp_ca_certificates")
|
|
781
|
+
|
|
782
|
+
@ocsp_ca_certificates.setter
|
|
783
|
+
def ocsp_ca_certificates(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
784
|
+
pulumi.set(self, "ocsp_ca_certificates", value)
|
|
785
|
+
|
|
786
|
+
@_builtins.property
|
|
787
|
+
@pulumi.getter(name="ocspEnabled")
|
|
788
|
+
def ocsp_enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
789
|
+
"""
|
|
790
|
+
If enabled, validate certificates'
|
|
791
|
+
revocation status using OCSP. Requires Vault version 1.13+.
|
|
792
|
+
"""
|
|
793
|
+
return pulumi.get(self, "ocsp_enabled")
|
|
794
|
+
|
|
795
|
+
@ocsp_enabled.setter
|
|
796
|
+
def ocsp_enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
797
|
+
pulumi.set(self, "ocsp_enabled", value)
|
|
798
|
+
|
|
799
|
+
@_builtins.property
|
|
800
|
+
@pulumi.getter(name="ocspFailOpen")
|
|
801
|
+
def ocsp_fail_open(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
802
|
+
"""
|
|
803
|
+
If true and an OCSP response cannot
|
|
804
|
+
be fetched or is of an unknown status, the login will proceed as if the
|
|
805
|
+
certificate has not been revoked.
|
|
806
|
+
Requires Vault version 1.13+.
|
|
807
|
+
"""
|
|
808
|
+
return pulumi.get(self, "ocsp_fail_open")
|
|
809
|
+
|
|
810
|
+
@ocsp_fail_open.setter
|
|
811
|
+
def ocsp_fail_open(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
812
|
+
pulumi.set(self, "ocsp_fail_open", value)
|
|
813
|
+
|
|
814
|
+
@_builtins.property
|
|
815
|
+
@pulumi.getter(name="ocspQueryAllServers")
|
|
816
|
+
def ocsp_query_all_servers(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
817
|
+
"""
|
|
818
|
+
If set to true, rather than
|
|
819
|
+
accepting the first successful OCSP response, query all servers and consider
|
|
820
|
+
the certificate valid only if all servers agree.
|
|
821
|
+
Requires Vault version 1.13+.
|
|
822
|
+
"""
|
|
823
|
+
return pulumi.get(self, "ocsp_query_all_servers")
|
|
824
|
+
|
|
825
|
+
@ocsp_query_all_servers.setter
|
|
826
|
+
def ocsp_query_all_servers(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
827
|
+
pulumi.set(self, "ocsp_query_all_servers", value)
|
|
828
|
+
|
|
829
|
+
@_builtins.property
|
|
830
|
+
@pulumi.getter(name="ocspServersOverrides")
|
|
831
|
+
def ocsp_servers_overrides(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
832
|
+
"""
|
|
833
|
+
: A comma-separated list of OCSP
|
|
834
|
+
server addresses. If unset, the OCSP server is determined from the
|
|
835
|
+
AuthorityInformationAccess extension on the certificate being inspected.
|
|
836
|
+
Requires Vault version 1.13+.
|
|
837
|
+
"""
|
|
838
|
+
return pulumi.get(self, "ocsp_servers_overrides")
|
|
839
|
+
|
|
840
|
+
@ocsp_servers_overrides.setter
|
|
841
|
+
def ocsp_servers_overrides(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
842
|
+
pulumi.set(self, "ocsp_servers_overrides", value)
|
|
843
|
+
|
|
844
|
+
@_builtins.property
|
|
845
|
+
@pulumi.getter(name="requiredExtensions")
|
|
846
|
+
def required_extensions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
847
|
+
"""
|
|
848
|
+
TLS extensions required on
|
|
849
|
+
client certificates
|
|
850
|
+
"""
|
|
851
|
+
return pulumi.get(self, "required_extensions")
|
|
852
|
+
|
|
853
|
+
@required_extensions.setter
|
|
854
|
+
def required_extensions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
855
|
+
pulumi.set(self, "required_extensions", value)
|
|
856
|
+
|
|
857
|
+
@_builtins.property
|
|
858
|
+
@pulumi.getter(name="tokenBoundCidrs")
|
|
859
|
+
def token_bound_cidrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
860
|
+
"""
|
|
861
|
+
Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
862
|
+
"""
|
|
863
|
+
return pulumi.get(self, "token_bound_cidrs")
|
|
864
|
+
|
|
865
|
+
@token_bound_cidrs.setter
|
|
866
|
+
def token_bound_cidrs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
867
|
+
pulumi.set(self, "token_bound_cidrs", value)
|
|
868
|
+
|
|
869
|
+
@_builtins.property
|
|
870
|
+
@pulumi.getter(name="tokenExplicitMaxTtl")
|
|
871
|
+
def token_explicit_max_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
872
|
+
"""
|
|
873
|
+
Generated Token's Explicit Maximum TTL in seconds
|
|
874
|
+
"""
|
|
875
|
+
return pulumi.get(self, "token_explicit_max_ttl")
|
|
876
|
+
|
|
877
|
+
@token_explicit_max_ttl.setter
|
|
878
|
+
def token_explicit_max_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
879
|
+
pulumi.set(self, "token_explicit_max_ttl", value)
|
|
880
|
+
|
|
881
|
+
@_builtins.property
|
|
882
|
+
@pulumi.getter(name="tokenMaxTtl")
|
|
883
|
+
def token_max_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
884
|
+
"""
|
|
885
|
+
The maximum lifetime of the generated token
|
|
886
|
+
"""
|
|
887
|
+
return pulumi.get(self, "token_max_ttl")
|
|
888
|
+
|
|
889
|
+
@token_max_ttl.setter
|
|
890
|
+
def token_max_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
891
|
+
pulumi.set(self, "token_max_ttl", value)
|
|
892
|
+
|
|
893
|
+
@_builtins.property
|
|
894
|
+
@pulumi.getter(name="tokenNoDefaultPolicy")
|
|
895
|
+
def token_no_default_policy(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
896
|
+
"""
|
|
897
|
+
If true, the 'default' policy will not automatically be added to generated tokens
|
|
898
|
+
"""
|
|
899
|
+
return pulumi.get(self, "token_no_default_policy")
|
|
900
|
+
|
|
901
|
+
@token_no_default_policy.setter
|
|
902
|
+
def token_no_default_policy(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
903
|
+
pulumi.set(self, "token_no_default_policy", value)
|
|
904
|
+
|
|
905
|
+
@_builtins.property
|
|
906
|
+
@pulumi.getter(name="tokenNumUses")
|
|
907
|
+
def token_num_uses(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
908
|
+
"""
|
|
909
|
+
The maximum number of times a token may be used, a value of zero means unlimited
|
|
910
|
+
"""
|
|
911
|
+
return pulumi.get(self, "token_num_uses")
|
|
912
|
+
|
|
913
|
+
@token_num_uses.setter
|
|
914
|
+
def token_num_uses(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
915
|
+
pulumi.set(self, "token_num_uses", value)
|
|
916
|
+
|
|
917
|
+
@_builtins.property
|
|
918
|
+
@pulumi.getter(name="tokenPeriod")
|
|
919
|
+
def token_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
920
|
+
"""
|
|
921
|
+
Generated Token's Period
|
|
922
|
+
"""
|
|
923
|
+
return pulumi.get(self, "token_period")
|
|
924
|
+
|
|
925
|
+
@token_period.setter
|
|
926
|
+
def token_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
927
|
+
pulumi.set(self, "token_period", value)
|
|
928
|
+
|
|
929
|
+
@_builtins.property
|
|
930
|
+
@pulumi.getter(name="tokenPolicies")
|
|
931
|
+
def token_policies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
932
|
+
"""
|
|
933
|
+
Generated Token's Policies
|
|
934
|
+
"""
|
|
935
|
+
return pulumi.get(self, "token_policies")
|
|
936
|
+
|
|
937
|
+
@token_policies.setter
|
|
938
|
+
def token_policies(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
939
|
+
pulumi.set(self, "token_policies", value)
|
|
940
|
+
|
|
941
|
+
@_builtins.property
|
|
942
|
+
@pulumi.getter(name="tokenTtl")
|
|
943
|
+
def token_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
944
|
+
"""
|
|
945
|
+
The initial ttl of the token to generate in seconds
|
|
946
|
+
"""
|
|
947
|
+
return pulumi.get(self, "token_ttl")
|
|
948
|
+
|
|
949
|
+
@token_ttl.setter
|
|
950
|
+
def token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
951
|
+
pulumi.set(self, "token_ttl", value)
|
|
952
|
+
|
|
953
|
+
@_builtins.property
|
|
954
|
+
@pulumi.getter(name="tokenType")
|
|
955
|
+
def token_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
956
|
+
"""
|
|
957
|
+
The type of token to generate, service or batch
|
|
958
|
+
"""
|
|
959
|
+
return pulumi.get(self, "token_type")
|
|
960
|
+
|
|
961
|
+
@token_type.setter
|
|
962
|
+
def token_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
963
|
+
pulumi.set(self, "token_type", value)
|
|
964
|
+
|
|
965
|
+
|
|
966
|
+
@pulumi.type_token("vault:index/certAuthBackendRole:CertAuthBackendRole")
|
|
967
|
+
class CertAuthBackendRole(pulumi.CustomResource):
|
|
968
|
+
@overload
|
|
969
|
+
def __init__(__self__,
|
|
970
|
+
resource_name: str,
|
|
971
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
972
|
+
alias_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
973
|
+
allowed_common_names: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
974
|
+
allowed_dns_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
975
|
+
allowed_email_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
976
|
+
allowed_names: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
977
|
+
allowed_organizational_units: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
978
|
+
allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
979
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
980
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
981
|
+
display_name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
982
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
983
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
984
|
+
ocsp_ca_certificates: Optional[pulumi.Input[_builtins.str]] = None,
|
|
985
|
+
ocsp_enabled: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
986
|
+
ocsp_fail_open: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
987
|
+
ocsp_query_all_servers: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
988
|
+
ocsp_servers_overrides: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
989
|
+
required_extensions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
990
|
+
token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
991
|
+
token_explicit_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
992
|
+
token_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
993
|
+
token_no_default_policy: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
994
|
+
token_num_uses: Optional[pulumi.Input[_builtins.int]] = None,
|
|
995
|
+
token_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
996
|
+
token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
997
|
+
token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
998
|
+
token_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
999
|
+
__props__=None):
|
|
1000
|
+
"""
|
|
1001
|
+
Provides a resource to create a role in an [Cert auth backend within Vault](https://www.vaultproject.io/docs/auth/cert.html).
|
|
1002
|
+
|
|
1003
|
+
## Example Usage
|
|
1004
|
+
|
|
1005
|
+
```python
|
|
1006
|
+
import pulumi
|
|
1007
|
+
import pulumi_std as std
|
|
1008
|
+
import pulumi_vault as vault
|
|
1009
|
+
|
|
1010
|
+
cert = vault.AuthBackend("cert",
|
|
1011
|
+
path="cert",
|
|
1012
|
+
type="cert")
|
|
1013
|
+
cert_cert_auth_backend_role = vault.CertAuthBackendRole("cert",
|
|
1014
|
+
name="foo",
|
|
1015
|
+
certificate=std.file(input="/path/to/certs/ca-cert.pem").result,
|
|
1016
|
+
backend=cert.path,
|
|
1017
|
+
allowed_names=[
|
|
1018
|
+
"foo.example.org",
|
|
1019
|
+
"baz.example.org",
|
|
1020
|
+
],
|
|
1021
|
+
token_ttl=300,
|
|
1022
|
+
token_max_ttl=600,
|
|
1023
|
+
token_policies=["foo"])
|
|
1024
|
+
```
|
|
1025
|
+
|
|
1026
|
+
:param str resource_name: The name of the resource.
|
|
1027
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1028
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] alias_metadata: The metadata to be tied to generated entity alias.
|
|
1029
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
1030
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_common_names: Allowed the common names for authenticated client certificates
|
|
1031
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_dns_sans: Allowed alternative dns names for authenticated client certificates
|
|
1032
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_email_sans: Allowed emails for authenticated client certificates
|
|
1033
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_names: DEPRECATED: Please use the individual `allowed_X_sans` parameters instead. Allowed subject names for authenticated client certificates
|
|
1034
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_organizational_units: Allowed organization units for authenticated client certificates.
|
|
1035
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_uri_sans: Allowed URIs for authenticated client certificates
|
|
1036
|
+
:param pulumi.Input[_builtins.str] backend: Path to the mounted Cert auth backend
|
|
1037
|
+
:param pulumi.Input[_builtins.str] certificate: CA certificate used to validate client certificates
|
|
1038
|
+
:param pulumi.Input[_builtins.str] display_name: The name to display on tokens issued under this role.
|
|
1039
|
+
:param pulumi.Input[_builtins.str] name: Name of the role
|
|
1040
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
1041
|
+
The value should not contain leading or trailing forward slashes.
|
|
1042
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1043
|
+
*Available only for Vault Enterprise*.
|
|
1044
|
+
:param pulumi.Input[_builtins.str] ocsp_ca_certificates: Any additional CA certificates
|
|
1045
|
+
needed to verify OCSP responses. Provided as base64 encoded PEM data.
|
|
1046
|
+
Requires Vault version 1.13+.
|
|
1047
|
+
:param pulumi.Input[_builtins.bool] ocsp_enabled: If enabled, validate certificates'
|
|
1048
|
+
revocation status using OCSP. Requires Vault version 1.13+.
|
|
1049
|
+
:param pulumi.Input[_builtins.bool] ocsp_fail_open: If true and an OCSP response cannot
|
|
1050
|
+
be fetched or is of an unknown status, the login will proceed as if the
|
|
1051
|
+
certificate has not been revoked.
|
|
1052
|
+
Requires Vault version 1.13+.
|
|
1053
|
+
:param pulumi.Input[_builtins.bool] ocsp_query_all_servers: If set to true, rather than
|
|
1054
|
+
accepting the first successful OCSP response, query all servers and consider
|
|
1055
|
+
the certificate valid only if all servers agree.
|
|
1056
|
+
Requires Vault version 1.13+.
|
|
1057
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] ocsp_servers_overrides: : A comma-separated list of OCSP
|
|
1058
|
+
server addresses. If unset, the OCSP server is determined from the
|
|
1059
|
+
AuthorityInformationAccess extension on the certificate being inspected.
|
|
1060
|
+
Requires Vault version 1.13+.
|
|
1061
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] required_extensions: TLS extensions required on
|
|
1062
|
+
client certificates
|
|
1063
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
1064
|
+
:param pulumi.Input[_builtins.int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
|
|
1065
|
+
:param pulumi.Input[_builtins.int] token_max_ttl: The maximum lifetime of the generated token
|
|
1066
|
+
:param pulumi.Input[_builtins.bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
|
|
1067
|
+
:param pulumi.Input[_builtins.int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
|
|
1068
|
+
:param pulumi.Input[_builtins.int] token_period: Generated Token's Period
|
|
1069
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_policies: Generated Token's Policies
|
|
1070
|
+
:param pulumi.Input[_builtins.int] token_ttl: The initial ttl of the token to generate in seconds
|
|
1071
|
+
:param pulumi.Input[_builtins.str] token_type: The type of token to generate, service or batch
|
|
1072
|
+
"""
|
|
1073
|
+
...
|
|
1074
|
+
@overload
|
|
1075
|
+
def __init__(__self__,
|
|
1076
|
+
resource_name: str,
|
|
1077
|
+
args: CertAuthBackendRoleArgs,
|
|
1078
|
+
opts: Optional[pulumi.ResourceOptions] = None):
|
|
1079
|
+
"""
|
|
1080
|
+
Provides a resource to create a role in an [Cert auth backend within Vault](https://www.vaultproject.io/docs/auth/cert.html).
|
|
1081
|
+
|
|
1082
|
+
## Example Usage
|
|
1083
|
+
|
|
1084
|
+
```python
|
|
1085
|
+
import pulumi
|
|
1086
|
+
import pulumi_std as std
|
|
1087
|
+
import pulumi_vault as vault
|
|
1088
|
+
|
|
1089
|
+
cert = vault.AuthBackend("cert",
|
|
1090
|
+
path="cert",
|
|
1091
|
+
type="cert")
|
|
1092
|
+
cert_cert_auth_backend_role = vault.CertAuthBackendRole("cert",
|
|
1093
|
+
name="foo",
|
|
1094
|
+
certificate=std.file(input="/path/to/certs/ca-cert.pem").result,
|
|
1095
|
+
backend=cert.path,
|
|
1096
|
+
allowed_names=[
|
|
1097
|
+
"foo.example.org",
|
|
1098
|
+
"baz.example.org",
|
|
1099
|
+
],
|
|
1100
|
+
token_ttl=300,
|
|
1101
|
+
token_max_ttl=600,
|
|
1102
|
+
token_policies=["foo"])
|
|
1103
|
+
```
|
|
1104
|
+
|
|
1105
|
+
:param str resource_name: The name of the resource.
|
|
1106
|
+
:param CertAuthBackendRoleArgs args: The arguments to use to populate this resource's properties.
|
|
1107
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1108
|
+
"""
|
|
1109
|
+
...
|
|
1110
|
+
def __init__(__self__, resource_name: str, *args, **kwargs):
|
|
1111
|
+
resource_args, opts = _utilities.get_resource_args_opts(CertAuthBackendRoleArgs, pulumi.ResourceOptions, *args, **kwargs)
|
|
1112
|
+
if resource_args is not None:
|
|
1113
|
+
__self__._internal_init(resource_name, opts, **resource_args.__dict__)
|
|
1114
|
+
else:
|
|
1115
|
+
__self__._internal_init(resource_name, *args, **kwargs)
|
|
1116
|
+
|
|
1117
|
+
def _internal_init(__self__,
|
|
1118
|
+
resource_name: str,
|
|
1119
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1120
|
+
alias_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1121
|
+
allowed_common_names: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1122
|
+
allowed_dns_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1123
|
+
allowed_email_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1124
|
+
allowed_names: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1125
|
+
allowed_organizational_units: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1126
|
+
allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1127
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1128
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1129
|
+
display_name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1130
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1131
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1132
|
+
ocsp_ca_certificates: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1133
|
+
ocsp_enabled: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1134
|
+
ocsp_fail_open: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1135
|
+
ocsp_query_all_servers: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1136
|
+
ocsp_servers_overrides: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1137
|
+
required_extensions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1138
|
+
token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1139
|
+
token_explicit_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1140
|
+
token_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1141
|
+
token_no_default_policy: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1142
|
+
token_num_uses: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1143
|
+
token_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1144
|
+
token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1145
|
+
token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1146
|
+
token_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1147
|
+
__props__=None):
|
|
1148
|
+
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
1149
|
+
if not isinstance(opts, pulumi.ResourceOptions):
|
|
1150
|
+
raise TypeError('Expected resource options to be a ResourceOptions instance')
|
|
1151
|
+
if opts.id is None:
|
|
1152
|
+
if __props__ is not None:
|
|
1153
|
+
raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
|
|
1154
|
+
__props__ = CertAuthBackendRoleArgs.__new__(CertAuthBackendRoleArgs)
|
|
1155
|
+
|
|
1156
|
+
__props__.__dict__["alias_metadata"] = alias_metadata
|
|
1157
|
+
__props__.__dict__["allowed_common_names"] = allowed_common_names
|
|
1158
|
+
__props__.__dict__["allowed_dns_sans"] = allowed_dns_sans
|
|
1159
|
+
__props__.__dict__["allowed_email_sans"] = allowed_email_sans
|
|
1160
|
+
__props__.__dict__["allowed_names"] = allowed_names
|
|
1161
|
+
__props__.__dict__["allowed_organizational_units"] = allowed_organizational_units
|
|
1162
|
+
__props__.__dict__["allowed_uri_sans"] = allowed_uri_sans
|
|
1163
|
+
__props__.__dict__["backend"] = backend
|
|
1164
|
+
if certificate is None and not opts.urn:
|
|
1165
|
+
raise TypeError("Missing required property 'certificate'")
|
|
1166
|
+
__props__.__dict__["certificate"] = certificate
|
|
1167
|
+
__props__.__dict__["display_name"] = display_name
|
|
1168
|
+
__props__.__dict__["name"] = name
|
|
1169
|
+
__props__.__dict__["namespace"] = namespace
|
|
1170
|
+
__props__.__dict__["ocsp_ca_certificates"] = ocsp_ca_certificates
|
|
1171
|
+
__props__.__dict__["ocsp_enabled"] = ocsp_enabled
|
|
1172
|
+
__props__.__dict__["ocsp_fail_open"] = ocsp_fail_open
|
|
1173
|
+
__props__.__dict__["ocsp_query_all_servers"] = ocsp_query_all_servers
|
|
1174
|
+
__props__.__dict__["ocsp_servers_overrides"] = ocsp_servers_overrides
|
|
1175
|
+
__props__.__dict__["required_extensions"] = required_extensions
|
|
1176
|
+
__props__.__dict__["token_bound_cidrs"] = token_bound_cidrs
|
|
1177
|
+
__props__.__dict__["token_explicit_max_ttl"] = token_explicit_max_ttl
|
|
1178
|
+
__props__.__dict__["token_max_ttl"] = token_max_ttl
|
|
1179
|
+
__props__.__dict__["token_no_default_policy"] = token_no_default_policy
|
|
1180
|
+
__props__.__dict__["token_num_uses"] = token_num_uses
|
|
1181
|
+
__props__.__dict__["token_period"] = token_period
|
|
1182
|
+
__props__.__dict__["token_policies"] = token_policies
|
|
1183
|
+
__props__.__dict__["token_ttl"] = token_ttl
|
|
1184
|
+
__props__.__dict__["token_type"] = token_type
|
|
1185
|
+
super(CertAuthBackendRole, __self__).__init__(
|
|
1186
|
+
'vault:index/certAuthBackendRole:CertAuthBackendRole',
|
|
1187
|
+
resource_name,
|
|
1188
|
+
__props__,
|
|
1189
|
+
opts)
|
|
1190
|
+
|
|
1191
|
+
@staticmethod
|
|
1192
|
+
def get(resource_name: str,
|
|
1193
|
+
id: pulumi.Input[str],
|
|
1194
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1195
|
+
alias_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1196
|
+
allowed_common_names: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1197
|
+
allowed_dns_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1198
|
+
allowed_email_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1199
|
+
allowed_names: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1200
|
+
allowed_organizational_units: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1201
|
+
allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1202
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1203
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1204
|
+
display_name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1205
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1206
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1207
|
+
ocsp_ca_certificates: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1208
|
+
ocsp_enabled: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1209
|
+
ocsp_fail_open: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1210
|
+
ocsp_query_all_servers: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1211
|
+
ocsp_servers_overrides: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1212
|
+
required_extensions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1213
|
+
token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1214
|
+
token_explicit_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1215
|
+
token_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1216
|
+
token_no_default_policy: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1217
|
+
token_num_uses: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1218
|
+
token_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1219
|
+
token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1220
|
+
token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1221
|
+
token_type: Optional[pulumi.Input[_builtins.str]] = None) -> 'CertAuthBackendRole':
|
|
1222
|
+
"""
|
|
1223
|
+
Get an existing CertAuthBackendRole resource's state with the given name, id, and optional extra
|
|
1224
|
+
properties used to qualify the lookup.
|
|
1225
|
+
|
|
1226
|
+
:param str resource_name: The unique name of the resulting resource.
|
|
1227
|
+
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
1228
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1229
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] alias_metadata: The metadata to be tied to generated entity alias.
|
|
1230
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
1231
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_common_names: Allowed the common names for authenticated client certificates
|
|
1232
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_dns_sans: Allowed alternative dns names for authenticated client certificates
|
|
1233
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_email_sans: Allowed emails for authenticated client certificates
|
|
1234
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_names: DEPRECATED: Please use the individual `allowed_X_sans` parameters instead. Allowed subject names for authenticated client certificates
|
|
1235
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_organizational_units: Allowed organization units for authenticated client certificates.
|
|
1236
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_uri_sans: Allowed URIs for authenticated client certificates
|
|
1237
|
+
:param pulumi.Input[_builtins.str] backend: Path to the mounted Cert auth backend
|
|
1238
|
+
:param pulumi.Input[_builtins.str] certificate: CA certificate used to validate client certificates
|
|
1239
|
+
:param pulumi.Input[_builtins.str] display_name: The name to display on tokens issued under this role.
|
|
1240
|
+
:param pulumi.Input[_builtins.str] name: Name of the role
|
|
1241
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
1242
|
+
The value should not contain leading or trailing forward slashes.
|
|
1243
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1244
|
+
*Available only for Vault Enterprise*.
|
|
1245
|
+
:param pulumi.Input[_builtins.str] ocsp_ca_certificates: Any additional CA certificates
|
|
1246
|
+
needed to verify OCSP responses. Provided as base64 encoded PEM data.
|
|
1247
|
+
Requires Vault version 1.13+.
|
|
1248
|
+
:param pulumi.Input[_builtins.bool] ocsp_enabled: If enabled, validate certificates'
|
|
1249
|
+
revocation status using OCSP. Requires Vault version 1.13+.
|
|
1250
|
+
:param pulumi.Input[_builtins.bool] ocsp_fail_open: If true and an OCSP response cannot
|
|
1251
|
+
be fetched or is of an unknown status, the login will proceed as if the
|
|
1252
|
+
certificate has not been revoked.
|
|
1253
|
+
Requires Vault version 1.13+.
|
|
1254
|
+
:param pulumi.Input[_builtins.bool] ocsp_query_all_servers: If set to true, rather than
|
|
1255
|
+
accepting the first successful OCSP response, query all servers and consider
|
|
1256
|
+
the certificate valid only if all servers agree.
|
|
1257
|
+
Requires Vault version 1.13+.
|
|
1258
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] ocsp_servers_overrides: : A comma-separated list of OCSP
|
|
1259
|
+
server addresses. If unset, the OCSP server is determined from the
|
|
1260
|
+
AuthorityInformationAccess extension on the certificate being inspected.
|
|
1261
|
+
Requires Vault version 1.13+.
|
|
1262
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] required_extensions: TLS extensions required on
|
|
1263
|
+
client certificates
|
|
1264
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
1265
|
+
:param pulumi.Input[_builtins.int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
|
|
1266
|
+
:param pulumi.Input[_builtins.int] token_max_ttl: The maximum lifetime of the generated token
|
|
1267
|
+
:param pulumi.Input[_builtins.bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
|
|
1268
|
+
:param pulumi.Input[_builtins.int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
|
|
1269
|
+
:param pulumi.Input[_builtins.int] token_period: Generated Token's Period
|
|
1270
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_policies: Generated Token's Policies
|
|
1271
|
+
:param pulumi.Input[_builtins.int] token_ttl: The initial ttl of the token to generate in seconds
|
|
1272
|
+
:param pulumi.Input[_builtins.str] token_type: The type of token to generate, service or batch
|
|
1273
|
+
"""
|
|
1274
|
+
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
1275
|
+
|
|
1276
|
+
__props__ = _CertAuthBackendRoleState.__new__(_CertAuthBackendRoleState)
|
|
1277
|
+
|
|
1278
|
+
__props__.__dict__["alias_metadata"] = alias_metadata
|
|
1279
|
+
__props__.__dict__["allowed_common_names"] = allowed_common_names
|
|
1280
|
+
__props__.__dict__["allowed_dns_sans"] = allowed_dns_sans
|
|
1281
|
+
__props__.__dict__["allowed_email_sans"] = allowed_email_sans
|
|
1282
|
+
__props__.__dict__["allowed_names"] = allowed_names
|
|
1283
|
+
__props__.__dict__["allowed_organizational_units"] = allowed_organizational_units
|
|
1284
|
+
__props__.__dict__["allowed_uri_sans"] = allowed_uri_sans
|
|
1285
|
+
__props__.__dict__["backend"] = backend
|
|
1286
|
+
__props__.__dict__["certificate"] = certificate
|
|
1287
|
+
__props__.__dict__["display_name"] = display_name
|
|
1288
|
+
__props__.__dict__["name"] = name
|
|
1289
|
+
__props__.__dict__["namespace"] = namespace
|
|
1290
|
+
__props__.__dict__["ocsp_ca_certificates"] = ocsp_ca_certificates
|
|
1291
|
+
__props__.__dict__["ocsp_enabled"] = ocsp_enabled
|
|
1292
|
+
__props__.__dict__["ocsp_fail_open"] = ocsp_fail_open
|
|
1293
|
+
__props__.__dict__["ocsp_query_all_servers"] = ocsp_query_all_servers
|
|
1294
|
+
__props__.__dict__["ocsp_servers_overrides"] = ocsp_servers_overrides
|
|
1295
|
+
__props__.__dict__["required_extensions"] = required_extensions
|
|
1296
|
+
__props__.__dict__["token_bound_cidrs"] = token_bound_cidrs
|
|
1297
|
+
__props__.__dict__["token_explicit_max_ttl"] = token_explicit_max_ttl
|
|
1298
|
+
__props__.__dict__["token_max_ttl"] = token_max_ttl
|
|
1299
|
+
__props__.__dict__["token_no_default_policy"] = token_no_default_policy
|
|
1300
|
+
__props__.__dict__["token_num_uses"] = token_num_uses
|
|
1301
|
+
__props__.__dict__["token_period"] = token_period
|
|
1302
|
+
__props__.__dict__["token_policies"] = token_policies
|
|
1303
|
+
__props__.__dict__["token_ttl"] = token_ttl
|
|
1304
|
+
__props__.__dict__["token_type"] = token_type
|
|
1305
|
+
return CertAuthBackendRole(resource_name, opts=opts, __props__=__props__)
|
|
1306
|
+
|
|
1307
|
+
@_builtins.property
|
|
1308
|
+
@pulumi.getter(name="aliasMetadata")
|
|
1309
|
+
def alias_metadata(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1310
|
+
"""
|
|
1311
|
+
The metadata to be tied to generated entity alias.
|
|
1312
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
1313
|
+
"""
|
|
1314
|
+
return pulumi.get(self, "alias_metadata")
|
|
1315
|
+
|
|
1316
|
+
@_builtins.property
|
|
1317
|
+
@pulumi.getter(name="allowedCommonNames")
|
|
1318
|
+
def allowed_common_names(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1319
|
+
"""
|
|
1320
|
+
Allowed the common names for authenticated client certificates
|
|
1321
|
+
"""
|
|
1322
|
+
return pulumi.get(self, "allowed_common_names")
|
|
1323
|
+
|
|
1324
|
+
@_builtins.property
|
|
1325
|
+
@pulumi.getter(name="allowedDnsSans")
|
|
1326
|
+
def allowed_dns_sans(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1327
|
+
"""
|
|
1328
|
+
Allowed alternative dns names for authenticated client certificates
|
|
1329
|
+
"""
|
|
1330
|
+
return pulumi.get(self, "allowed_dns_sans")
|
|
1331
|
+
|
|
1332
|
+
@_builtins.property
|
|
1333
|
+
@pulumi.getter(name="allowedEmailSans")
|
|
1334
|
+
def allowed_email_sans(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1335
|
+
"""
|
|
1336
|
+
Allowed emails for authenticated client certificates
|
|
1337
|
+
"""
|
|
1338
|
+
return pulumi.get(self, "allowed_email_sans")
|
|
1339
|
+
|
|
1340
|
+
@_builtins.property
|
|
1341
|
+
@pulumi.getter(name="allowedNames")
|
|
1342
|
+
def allowed_names(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1343
|
+
"""
|
|
1344
|
+
DEPRECATED: Please use the individual `allowed_X_sans` parameters instead. Allowed subject names for authenticated client certificates
|
|
1345
|
+
"""
|
|
1346
|
+
return pulumi.get(self, "allowed_names")
|
|
1347
|
+
|
|
1348
|
+
@_builtins.property
|
|
1349
|
+
@pulumi.getter(name="allowedOrganizationalUnits")
|
|
1350
|
+
def allowed_organizational_units(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1351
|
+
"""
|
|
1352
|
+
Allowed organization units for authenticated client certificates.
|
|
1353
|
+
"""
|
|
1354
|
+
return pulumi.get(self, "allowed_organizational_units")
|
|
1355
|
+
|
|
1356
|
+
@_builtins.property
|
|
1357
|
+
@pulumi.getter(name="allowedUriSans")
|
|
1358
|
+
def allowed_uri_sans(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1359
|
+
"""
|
|
1360
|
+
Allowed URIs for authenticated client certificates
|
|
1361
|
+
"""
|
|
1362
|
+
return pulumi.get(self, "allowed_uri_sans")
|
|
1363
|
+
|
|
1364
|
+
@_builtins.property
|
|
1365
|
+
@pulumi.getter
|
|
1366
|
+
def backend(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1367
|
+
"""
|
|
1368
|
+
Path to the mounted Cert auth backend
|
|
1369
|
+
"""
|
|
1370
|
+
return pulumi.get(self, "backend")
|
|
1371
|
+
|
|
1372
|
+
@_builtins.property
|
|
1373
|
+
@pulumi.getter
|
|
1374
|
+
def certificate(self) -> pulumi.Output[_builtins.str]:
|
|
1375
|
+
"""
|
|
1376
|
+
CA certificate used to validate client certificates
|
|
1377
|
+
"""
|
|
1378
|
+
return pulumi.get(self, "certificate")
|
|
1379
|
+
|
|
1380
|
+
@_builtins.property
|
|
1381
|
+
@pulumi.getter(name="displayName")
|
|
1382
|
+
def display_name(self) -> pulumi.Output[_builtins.str]:
|
|
1383
|
+
"""
|
|
1384
|
+
The name to display on tokens issued under this role.
|
|
1385
|
+
"""
|
|
1386
|
+
return pulumi.get(self, "display_name")
|
|
1387
|
+
|
|
1388
|
+
@_builtins.property
|
|
1389
|
+
@pulumi.getter
|
|
1390
|
+
def name(self) -> pulumi.Output[_builtins.str]:
|
|
1391
|
+
"""
|
|
1392
|
+
Name of the role
|
|
1393
|
+
"""
|
|
1394
|
+
return pulumi.get(self, "name")
|
|
1395
|
+
|
|
1396
|
+
@_builtins.property
|
|
1397
|
+
@pulumi.getter
|
|
1398
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1399
|
+
"""
|
|
1400
|
+
The namespace to provision the resource in.
|
|
1401
|
+
The value should not contain leading or trailing forward slashes.
|
|
1402
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1403
|
+
*Available only for Vault Enterprise*.
|
|
1404
|
+
"""
|
|
1405
|
+
return pulumi.get(self, "namespace")
|
|
1406
|
+
|
|
1407
|
+
@_builtins.property
|
|
1408
|
+
@pulumi.getter(name="ocspCaCertificates")
|
|
1409
|
+
def ocsp_ca_certificates(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1410
|
+
"""
|
|
1411
|
+
Any additional CA certificates
|
|
1412
|
+
needed to verify OCSP responses. Provided as base64 encoded PEM data.
|
|
1413
|
+
Requires Vault version 1.13+.
|
|
1414
|
+
"""
|
|
1415
|
+
return pulumi.get(self, "ocsp_ca_certificates")
|
|
1416
|
+
|
|
1417
|
+
@_builtins.property
|
|
1418
|
+
@pulumi.getter(name="ocspEnabled")
|
|
1419
|
+
def ocsp_enabled(self) -> pulumi.Output[_builtins.bool]:
|
|
1420
|
+
"""
|
|
1421
|
+
If enabled, validate certificates'
|
|
1422
|
+
revocation status using OCSP. Requires Vault version 1.13+.
|
|
1423
|
+
"""
|
|
1424
|
+
return pulumi.get(self, "ocsp_enabled")
|
|
1425
|
+
|
|
1426
|
+
@_builtins.property
|
|
1427
|
+
@pulumi.getter(name="ocspFailOpen")
|
|
1428
|
+
def ocsp_fail_open(self) -> pulumi.Output[_builtins.bool]:
|
|
1429
|
+
"""
|
|
1430
|
+
If true and an OCSP response cannot
|
|
1431
|
+
be fetched or is of an unknown status, the login will proceed as if the
|
|
1432
|
+
certificate has not been revoked.
|
|
1433
|
+
Requires Vault version 1.13+.
|
|
1434
|
+
"""
|
|
1435
|
+
return pulumi.get(self, "ocsp_fail_open")
|
|
1436
|
+
|
|
1437
|
+
@_builtins.property
|
|
1438
|
+
@pulumi.getter(name="ocspQueryAllServers")
|
|
1439
|
+
def ocsp_query_all_servers(self) -> pulumi.Output[_builtins.bool]:
|
|
1440
|
+
"""
|
|
1441
|
+
If set to true, rather than
|
|
1442
|
+
accepting the first successful OCSP response, query all servers and consider
|
|
1443
|
+
the certificate valid only if all servers agree.
|
|
1444
|
+
Requires Vault version 1.13+.
|
|
1445
|
+
"""
|
|
1446
|
+
return pulumi.get(self, "ocsp_query_all_servers")
|
|
1447
|
+
|
|
1448
|
+
@_builtins.property
|
|
1449
|
+
@pulumi.getter(name="ocspServersOverrides")
|
|
1450
|
+
def ocsp_servers_overrides(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1451
|
+
"""
|
|
1452
|
+
: A comma-separated list of OCSP
|
|
1453
|
+
server addresses. If unset, the OCSP server is determined from the
|
|
1454
|
+
AuthorityInformationAccess extension on the certificate being inspected.
|
|
1455
|
+
Requires Vault version 1.13+.
|
|
1456
|
+
"""
|
|
1457
|
+
return pulumi.get(self, "ocsp_servers_overrides")
|
|
1458
|
+
|
|
1459
|
+
@_builtins.property
|
|
1460
|
+
@pulumi.getter(name="requiredExtensions")
|
|
1461
|
+
def required_extensions(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1462
|
+
"""
|
|
1463
|
+
TLS extensions required on
|
|
1464
|
+
client certificates
|
|
1465
|
+
"""
|
|
1466
|
+
return pulumi.get(self, "required_extensions")
|
|
1467
|
+
|
|
1468
|
+
@_builtins.property
|
|
1469
|
+
@pulumi.getter(name="tokenBoundCidrs")
|
|
1470
|
+
def token_bound_cidrs(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1471
|
+
"""
|
|
1472
|
+
Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
1473
|
+
"""
|
|
1474
|
+
return pulumi.get(self, "token_bound_cidrs")
|
|
1475
|
+
|
|
1476
|
+
@_builtins.property
|
|
1477
|
+
@pulumi.getter(name="tokenExplicitMaxTtl")
|
|
1478
|
+
def token_explicit_max_ttl(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1479
|
+
"""
|
|
1480
|
+
Generated Token's Explicit Maximum TTL in seconds
|
|
1481
|
+
"""
|
|
1482
|
+
return pulumi.get(self, "token_explicit_max_ttl")
|
|
1483
|
+
|
|
1484
|
+
@_builtins.property
|
|
1485
|
+
@pulumi.getter(name="tokenMaxTtl")
|
|
1486
|
+
def token_max_ttl(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1487
|
+
"""
|
|
1488
|
+
The maximum lifetime of the generated token
|
|
1489
|
+
"""
|
|
1490
|
+
return pulumi.get(self, "token_max_ttl")
|
|
1491
|
+
|
|
1492
|
+
@_builtins.property
|
|
1493
|
+
@pulumi.getter(name="tokenNoDefaultPolicy")
|
|
1494
|
+
def token_no_default_policy(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1495
|
+
"""
|
|
1496
|
+
If true, the 'default' policy will not automatically be added to generated tokens
|
|
1497
|
+
"""
|
|
1498
|
+
return pulumi.get(self, "token_no_default_policy")
|
|
1499
|
+
|
|
1500
|
+
@_builtins.property
|
|
1501
|
+
@pulumi.getter(name="tokenNumUses")
|
|
1502
|
+
def token_num_uses(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1503
|
+
"""
|
|
1504
|
+
The maximum number of times a token may be used, a value of zero means unlimited
|
|
1505
|
+
"""
|
|
1506
|
+
return pulumi.get(self, "token_num_uses")
|
|
1507
|
+
|
|
1508
|
+
@_builtins.property
|
|
1509
|
+
@pulumi.getter(name="tokenPeriod")
|
|
1510
|
+
def token_period(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1511
|
+
"""
|
|
1512
|
+
Generated Token's Period
|
|
1513
|
+
"""
|
|
1514
|
+
return pulumi.get(self, "token_period")
|
|
1515
|
+
|
|
1516
|
+
@_builtins.property
|
|
1517
|
+
@pulumi.getter(name="tokenPolicies")
|
|
1518
|
+
def token_policies(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1519
|
+
"""
|
|
1520
|
+
Generated Token's Policies
|
|
1521
|
+
"""
|
|
1522
|
+
return pulumi.get(self, "token_policies")
|
|
1523
|
+
|
|
1524
|
+
@_builtins.property
|
|
1525
|
+
@pulumi.getter(name="tokenTtl")
|
|
1526
|
+
def token_ttl(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1527
|
+
"""
|
|
1528
|
+
The initial ttl of the token to generate in seconds
|
|
1529
|
+
"""
|
|
1530
|
+
return pulumi.get(self, "token_ttl")
|
|
1531
|
+
|
|
1532
|
+
@_builtins.property
|
|
1533
|
+
@pulumi.getter(name="tokenType")
|
|
1534
|
+
def token_type(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1535
|
+
"""
|
|
1536
|
+
The type of token to generate, service or batch
|
|
1537
|
+
"""
|
|
1538
|
+
return pulumi.get(self, "token_type")
|
|
1539
|
+
|