@pulumi/gcp
Version:
A Pulumi package for creating and managing Google Cloud Platform resources.
553 lines • 25.7 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
* A Secret is a logical secret whose value and versions can be accessed.
*
* To get more information about Secret, see:
*
* * [API documentation](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets)
* * How-to Guides
* * [Create and deploy a Secret](https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets)
*
* ## Example Usage
*
* ### Secret Config Basic
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const secret_basic = new gcp.secretmanager.Secret("secret-basic", {
* secretId: "secret",
* labels: {
* label: "my-label",
* },
* replication: {
* userManaged: {
* replicas: [
* {
* location: "us-central1",
* },
* {
* location: "us-east1",
* },
* ],
* },
* },
* deletionProtection: false,
* });
* ```
* ### Secret With Annotations
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const secret_with_annotations = new gcp.secretmanager.Secret("secret-with-annotations", {
* secretId: "secret",
* labels: {
* label: "my-label",
* },
* annotations: {
* key1: "someval",
* key2: "someval2",
* key3: "someval3",
* key4: "someval4",
* key5: "someval5",
* },
* replication: {
* auto: {},
* },
* });
* ```
* ### Secret With Version Destroy Ttl
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const secret_with_version_destroy_ttl = new gcp.secretmanager.Secret("secret-with-version-destroy-ttl", {
* secretId: "secret",
* versionDestroyTtl: "2592000s",
* replication: {
* auto: {},
* },
* });
* ```
* ### Secret With Automatic Cmek
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
*
* const project = gcp.organizations.getProject({});
* const kms_secret_binding = new gcp.kms.CryptoKeyIAMMember("kms-secret-binding", {
* cryptoKeyId: "kms-key",
* role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
* member: project.then(project => `serviceAccount:service-${project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com`),
* });
* const secret_with_automatic_cmek = new gcp.secretmanager.Secret("secret-with-automatic-cmek", {
* secretId: "secret",
* replication: {
* auto: {
* customerManagedEncryption: {
* kmsKeyName: "kms-key",
* },
* },
* },
* }, {
* dependsOn: [kms_secret_binding],
* });
* ```
*
* ## Import
*
* Secret can be imported using any of these accepted formats:
*
* * `projects/{{project}}/secrets/{{secret_id}}`
* * `{{project}}/{{secret_id}}`
* * `{{secret_id}}`
*
* When using the `pulumi import` command, Secret can be imported using one of the formats above. For example:
*
* ```sh
* $ pulumi import gcp:secretmanager/secret:Secret default projects/{{project}}/secrets/{{secret_id}}
* $ pulumi import gcp:secretmanager/secret:Secret default {{project}}/{{secret_id}}
* $ pulumi import gcp:secretmanager/secret:Secret default {{secret_id}}
* ```
*/
export declare class Secret extends pulumi.CustomResource {
/**
* Get an existing Secret resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: SecretState, opts?: pulumi.CustomResourceOptions): Secret;
/**
* Returns true if the given object is an instance of Secret. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is Secret;
/**
* Custom metadata about the secret.
* Annotations are distinct from various forms of labels. Annotations exist to allow
* client tools to store their own state information without requiring a database.
* Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of
* maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and
* may have dashes (-), underscores (_), dots (.), and alphanumerics in between these
* symbols.
* The total size of annotation keys and values must be less than 16KiB.
* An object containing a list of "key": value pairs. Example:
* { "name": "wrench", "mass": "1.3kg", "count": "3" }.
*
* **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
* Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource.
*/
readonly annotations: pulumi.Output<{
[key: string]: string;
} | undefined>;
/**
* The time at which the Secret was created.
*/
readonly createTime: pulumi.Output<string>;
/**
* Whether Terraform will be prevented from destroying the resource. Defaults to DELETE.
* When a 'terraform destroy' or 'pulumi up' would delete the resource,
* the command will fail if this field is set to "PREVENT" in Terraform state.
* When set to "ABANDON", the command will remove the resource from Terraform
* management without updating or deleting the resource in the API.
* When set to "DELETE", deleting the resource is allowed.
*/
readonly deletionPolicy: pulumi.Output<string>;
/**
* Whether Terraform will be prevented from destroying the secret. Defaults to false.
* When the field is set to true in Terraform state, a `pulumi up`
* or `terraform destroy` that would delete the secret will fail.
*/
readonly deletionProtection: pulumi.Output<boolean | undefined>;
/**
* All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services.
*/
readonly effectiveAnnotations: pulumi.Output<{
[key: string]: string;
}>;
/**
* All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
*/
readonly effectiveLabels: pulumi.Output<{
[key: string]: string;
}>;
/**
* Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.
* A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
* Only one of `expireTime` or `ttl` can be provided.
*/
readonly expireTime: pulumi.Output<string>;
/**
* The labels assigned to this Secret.
* Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
* and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}
* Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
* and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63}
* No more than 64 labels can be assigned to a given resource.
* An object containing a list of "key": value pairs. Example:
* { "name": "wrench", "mass": "1.3kg", "count": "3" }.
*
* **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
* Please refer to the field `effectiveLabels` for all of the labels present on the resource.
*/
readonly labels: pulumi.Output<{
[key: string]: string;
} | undefined>;
/**
* The resource name of the Secret. Format:
* `projects/{{project}}/secrets/{{secret_id}}`
*/
readonly name: pulumi.Output<string>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
readonly project: pulumi.Output<string>;
/**
* The combination of labels configured directly on the resource
* and default labels configured on the provider.
*/
readonly pulumiLabels: pulumi.Output<{
[key: string]: string;
}>;
/**
* The replication policy of the secret data attached to the Secret. It cannot be changed
* after the Secret has been created.
* Structure is documented below.
*/
readonly replication: pulumi.Output<outputs.secretmanager.SecretReplication>;
/**
* The rotation time and period for a Secret. At `nextRotationTime`, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. `topics` must be set to configure rotation.
* Structure is documented below.
*/
readonly rotation: pulumi.Output<outputs.secretmanager.SecretRotation | undefined>;
/**
* This must be unique within the project.
*/
readonly secretId: pulumi.Output<string>;
/**
* A map of resource manager tags.
* Resource manager tag keys and values have the same definition as resource manager tags.
* Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/{tag_value_id}.
*/
readonly tags: pulumi.Output<{
[key: string]: string;
} | undefined>;
/**
* A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions.
* Structure is documented below.
*/
readonly topics: pulumi.Output<outputs.secretmanager.SecretTopic[] | undefined>;
/**
* The TTL for the Secret.
* A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
* Only one of `ttl` or `expireTime` can be provided.
*/
readonly ttl: pulumi.Output<string | undefined>;
/**
* Mapping from version alias to version name.
* A version alias is a string with a maximum length of 63 characters and can contain
* uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')
* characters. An alias string must start with a letter and cannot be the string
* 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.
* An object containing a list of "key": value pairs. Example:
* { "name": "wrench", "mass": "1.3kg", "count": "3" }.
*/
readonly versionAliases: pulumi.Output<{
[key: string]: string;
} | undefined>;
/**
* Secret Version TTL after destruction request.
* This is a part of the delayed delete feature on Secret Version.
* For secret with versionDestroyTtl>0, version destruction doesn't happen immediately
* on calling destroy instead the version goes to a disabled state and
* the actual destruction happens after this TTL expires.
*/
readonly versionDestroyTtl: pulumi.Output<string | undefined>;
/**
* Create a Secret resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: SecretArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering Secret resources.
*/
export interface SecretState {
/**
* Custom metadata about the secret.
* Annotations are distinct from various forms of labels. Annotations exist to allow
* client tools to store their own state information without requiring a database.
* Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of
* maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and
* may have dashes (-), underscores (_), dots (.), and alphanumerics in between these
* symbols.
* The total size of annotation keys and values must be less than 16KiB.
* An object containing a list of "key": value pairs. Example:
* { "name": "wrench", "mass": "1.3kg", "count": "3" }.
*
* **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
* Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource.
*/
annotations?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* The time at which the Secret was created.
*/
createTime?: pulumi.Input<string | undefined>;
/**
* Whether Terraform will be prevented from destroying the resource. Defaults to DELETE.
* When a 'terraform destroy' or 'pulumi up' would delete the resource,
* the command will fail if this field is set to "PREVENT" in Terraform state.
* When set to "ABANDON", the command will remove the resource from Terraform
* management without updating or deleting the resource in the API.
* When set to "DELETE", deleting the resource is allowed.
*/
deletionPolicy?: pulumi.Input<string | undefined>;
/**
* Whether Terraform will be prevented from destroying the secret. Defaults to false.
* When the field is set to true in Terraform state, a `pulumi up`
* or `terraform destroy` that would delete the secret will fail.
*/
deletionProtection?: pulumi.Input<boolean | undefined>;
/**
* All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services.
*/
effectiveAnnotations?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
*/
effectiveLabels?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.
* A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
* Only one of `expireTime` or `ttl` can be provided.
*/
expireTime?: pulumi.Input<string | undefined>;
/**
* The labels assigned to this Secret.
* Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
* and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}
* Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
* and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63}
* No more than 64 labels can be assigned to a given resource.
* An object containing a list of "key": value pairs. Example:
* { "name": "wrench", "mass": "1.3kg", "count": "3" }.
*
* **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
* Please refer to the field `effectiveLabels` for all of the labels present on the resource.
*/
labels?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* The resource name of the Secret. Format:
* `projects/{{project}}/secrets/{{secret_id}}`
*/
name?: pulumi.Input<string | undefined>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
project?: pulumi.Input<string | undefined>;
/**
* The combination of labels configured directly on the resource
* and default labels configured on the provider.
*/
pulumiLabels?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* The replication policy of the secret data attached to the Secret. It cannot be changed
* after the Secret has been created.
* Structure is documented below.
*/
replication?: pulumi.Input<inputs.secretmanager.SecretReplication | undefined>;
/**
* The rotation time and period for a Secret. At `nextRotationTime`, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. `topics` must be set to configure rotation.
* Structure is documented below.
*/
rotation?: pulumi.Input<inputs.secretmanager.SecretRotation | undefined>;
/**
* This must be unique within the project.
*/
secretId?: pulumi.Input<string | undefined>;
/**
* A map of resource manager tags.
* Resource manager tag keys and values have the same definition as resource manager tags.
* Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/{tag_value_id}.
*/
tags?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions.
* Structure is documented below.
*/
topics?: pulumi.Input<pulumi.Input<inputs.secretmanager.SecretTopic>[] | undefined>;
/**
* The TTL for the Secret.
* A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
* Only one of `ttl` or `expireTime` can be provided.
*/
ttl?: pulumi.Input<string | undefined>;
/**
* Mapping from version alias to version name.
* A version alias is a string with a maximum length of 63 characters and can contain
* uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')
* characters. An alias string must start with a letter and cannot be the string
* 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.
* An object containing a list of "key": value pairs. Example:
* { "name": "wrench", "mass": "1.3kg", "count": "3" }.
*/
versionAliases?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* Secret Version TTL after destruction request.
* This is a part of the delayed delete feature on Secret Version.
* For secret with versionDestroyTtl>0, version destruction doesn't happen immediately
* on calling destroy instead the version goes to a disabled state and
* the actual destruction happens after this TTL expires.
*/
versionDestroyTtl?: pulumi.Input<string | undefined>;
}
/**
* The set of arguments for constructing a Secret resource.
*/
export interface SecretArgs {
/**
* Custom metadata about the secret.
* Annotations are distinct from various forms of labels. Annotations exist to allow
* client tools to store their own state information without requiring a database.
* Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of
* maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and
* may have dashes (-), underscores (_), dots (.), and alphanumerics in between these
* symbols.
* The total size of annotation keys and values must be less than 16KiB.
* An object containing a list of "key": value pairs. Example:
* { "name": "wrench", "mass": "1.3kg", "count": "3" }.
*
* **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
* Please refer to the field `effectiveAnnotations` for all of the annotations present on the resource.
*/
annotations?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* Whether Terraform will be prevented from destroying the resource. Defaults to DELETE.
* When a 'terraform destroy' or 'pulumi up' would delete the resource,
* the command will fail if this field is set to "PREVENT" in Terraform state.
* When set to "ABANDON", the command will remove the resource from Terraform
* management without updating or deleting the resource in the API.
* When set to "DELETE", deleting the resource is allowed.
*/
deletionPolicy?: pulumi.Input<string | undefined>;
/**
* Whether Terraform will be prevented from destroying the secret. Defaults to false.
* When the field is set to true in Terraform state, a `pulumi up`
* or `terraform destroy` that would delete the secret will fail.
*/
deletionProtection?: pulumi.Input<boolean | undefined>;
/**
* Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.
* A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
* Only one of `expireTime` or `ttl` can be provided.
*/
expireTime?: pulumi.Input<string | undefined>;
/**
* The labels assigned to this Secret.
* Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
* and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}
* Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
* and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63}
* No more than 64 labels can be assigned to a given resource.
* An object containing a list of "key": value pairs. Example:
* { "name": "wrench", "mass": "1.3kg", "count": "3" }.
*
* **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
* Please refer to the field `effectiveLabels` for all of the labels present on the resource.
*/
labels?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
project?: pulumi.Input<string | undefined>;
/**
* The replication policy of the secret data attached to the Secret. It cannot be changed
* after the Secret has been created.
* Structure is documented below.
*/
replication: pulumi.Input<inputs.secretmanager.SecretReplication>;
/**
* The rotation time and period for a Secret. At `nextRotationTime`, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. `topics` must be set to configure rotation.
* Structure is documented below.
*/
rotation?: pulumi.Input<inputs.secretmanager.SecretRotation | undefined>;
/**
* This must be unique within the project.
*/
secretId?: pulumi.Input<string | undefined>;
/**
* A map of resource manager tags.
* Resource manager tag keys and values have the same definition as resource manager tags.
* Keys must be in the format tagKeys/{tag_key_id}, and values are in the format tagValues/{tag_value_id}.
*/
tags?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions.
* Structure is documented below.
*/
topics?: pulumi.Input<pulumi.Input<inputs.secretmanager.SecretTopic>[] | undefined>;
/**
* The TTL for the Secret.
* A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
* Only one of `ttl` or `expireTime` can be provided.
*/
ttl?: pulumi.Input<string | undefined>;
/**
* Mapping from version alias to version name.
* A version alias is a string with a maximum length of 63 characters and can contain
* uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')
* characters. An alias string must start with a letter and cannot be the string
* 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.
* An object containing a list of "key": value pairs. Example:
* { "name": "wrench", "mass": "1.3kg", "count": "3" }.
*/
versionAliases?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* Secret Version TTL after destruction request.
* This is a part of the delayed delete feature on Secret Version.
* For secret with versionDestroyTtl>0, version destruction doesn't happen immediately
* on calling destroy instead the version goes to a disabled state and
* the actual destruction happens after this TTL expires.
*/
versionDestroyTtl?: pulumi.Input<string | undefined>;
}
//# sourceMappingURL=secret.d.ts.map