@pulumi/vault
Version:
A Pulumi package for creating and managing HashiCorp Vault cloud resources.
375 lines (374 loc) • 16.4 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
* Provides a resource to configure the [GCP auth backend within Vault](https://www.vaultproject.io/docs/auth/gcp.html).
*
* ## Example Usage
*
* You can setup the GCP auth backend with Workload Identity Federation (WIF) for a secret-less configuration:
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as vault from "@pulumi/vault";
*
* const gcp = new vault.gcp.AuthBackend("gcp", {
* identityTokenKey: "example-key",
* identityTokenTtl: 1800,
* identityTokenAudience: "<TOKEN_AUDIENCE>",
* serviceAccountEmail: "<SERVICE_ACCOUNT_EMAIL>",
* rotationSchedule: "0 * * * SAT",
* rotationWindow: 3600,
* });
* ```
*
* ## Import
*
* GCP authentication backends can be imported using the backend name, e.g.
*
* ```sh
* $ pulumi import vault:gcp/authBackend:AuthBackend gcp gcp
* ```
*/
export declare class AuthBackend extends pulumi.CustomResource {
/**
* Get an existing AuthBackend resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AuthBackendState, opts?: pulumi.CustomResourceOptions): AuthBackend;
/**
* Returns true if the given object is an instance of AuthBackend. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is AuthBackend;
/**
* The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).
*/
readonly accessor: pulumi.Output<string>;
/**
* The clients email associated with the credentials
*/
readonly clientEmail: pulumi.Output<string>;
/**
* The Client ID of the credentials
*/
readonly clientId: pulumi.Output<string>;
/**
* A JSON string containing the contents of a GCP credentials file. If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running.
*/
readonly credentials: pulumi.Output<string | undefined>;
/**
* Specifies overrides to
* [service endpoints](https://cloud.google.com/apis/design/glossary#api_service_endpoint)
* used when making API requests. This allows specific requests made during authentication
* to target alternative service endpoints for use in [Private Google Access](https://cloud.google.com/vpc/docs/configure-private-google-access)
* environments. Requires Vault 1.11+.
*
* Overrides are set at the subdomain level using the following keys:
*/
readonly customEndpoint: pulumi.Output<outputs.gcp.AuthBackendCustomEndpoint | undefined>;
/**
* A description of the auth method.
*/
readonly description: pulumi.Output<string | undefined>;
/**
* Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
*/
readonly disableAutomatedRotation: pulumi.Output<boolean | undefined>;
/**
* If set, opts out of mount migration on path updates.
* See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
*/
readonly disableRemount: pulumi.Output<boolean | undefined>;
/**
* The audience claim value for plugin identity
* tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
* Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
*/
readonly identityTokenAudience: pulumi.Output<string | undefined>;
/**
* The key to use for signing plugin identity
* tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
*/
readonly identityTokenKey: pulumi.Output<string | undefined>;
/**
* The TTL of generated tokens.
*/
readonly identityTokenTtl: pulumi.Output<number | undefined>;
/**
* Specifies if the auth method is local only.
*/
readonly local: pulumi.Output<boolean | undefined>;
/**
* The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
*/
readonly namespace: pulumi.Output<string | undefined>;
/**
* The path to mount the auth method — this defaults to 'gcp'.
*/
readonly path: pulumi.Output<string | undefined>;
/**
* The ID of the private key from the credentials
*/
readonly privateKeyId: pulumi.Output<string>;
/**
* The GCP Project ID
*/
readonly projectId: pulumi.Output<string>;
/**
* The amount of time in seconds Vault should wait before rotating the root credential.
* A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
*/
readonly rotationPeriod: pulumi.Output<number | undefined>;
/**
* The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
* defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
*/
readonly rotationSchedule: pulumi.Output<string | undefined>;
/**
* The maximum amount of time in seconds allowed to complete
* a rotation when a scheduled token rotation occurs. The default rotation window is
* unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
*/
readonly rotationWindow: pulumi.Output<number | undefined>;
/**
* Service Account to impersonate for plugin workload identity federation.
* Required with `identityTokenAudience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
*/
readonly serviceAccountEmail: pulumi.Output<string | undefined>;
/**
* Extra configuration block. Structure is documented below.
*
* The `tune` block is used to tune the auth backend:
*/
readonly tune: pulumi.Output<outputs.gcp.AuthBackendTune>;
/**
* Create a AuthBackend resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args?: AuthBackendArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering AuthBackend resources.
*/
export interface AuthBackendState {
/**
* The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).
*/
accessor?: pulumi.Input<string>;
/**
* The clients email associated with the credentials
*/
clientEmail?: pulumi.Input<string>;
/**
* The Client ID of the credentials
*/
clientId?: pulumi.Input<string>;
/**
* A JSON string containing the contents of a GCP credentials file. If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running.
*/
credentials?: pulumi.Input<string>;
/**
* Specifies overrides to
* [service endpoints](https://cloud.google.com/apis/design/glossary#api_service_endpoint)
* used when making API requests. This allows specific requests made during authentication
* to target alternative service endpoints for use in [Private Google Access](https://cloud.google.com/vpc/docs/configure-private-google-access)
* environments. Requires Vault 1.11+.
*
* Overrides are set at the subdomain level using the following keys:
*/
customEndpoint?: pulumi.Input<inputs.gcp.AuthBackendCustomEndpoint>;
/**
* A description of the auth method.
*/
description?: pulumi.Input<string>;
/**
* Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
*/
disableAutomatedRotation?: pulumi.Input<boolean>;
/**
* If set, opts out of mount migration on path updates.
* See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
*/
disableRemount?: pulumi.Input<boolean>;
/**
* The audience claim value for plugin identity
* tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
* Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
*/
identityTokenAudience?: pulumi.Input<string>;
/**
* The key to use for signing plugin identity
* tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
*/
identityTokenKey?: pulumi.Input<string>;
/**
* The TTL of generated tokens.
*/
identityTokenTtl?: pulumi.Input<number>;
/**
* Specifies if the auth method is local only.
*/
local?: pulumi.Input<boolean>;
/**
* The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
*/
namespace?: pulumi.Input<string>;
/**
* The path to mount the auth method — this defaults to 'gcp'.
*/
path?: pulumi.Input<string>;
/**
* The ID of the private key from the credentials
*/
privateKeyId?: pulumi.Input<string>;
/**
* The GCP Project ID
*/
projectId?: pulumi.Input<string>;
/**
* The amount of time in seconds Vault should wait before rotating the root credential.
* A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
*/
rotationPeriod?: pulumi.Input<number>;
/**
* The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
* defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
*/
rotationSchedule?: pulumi.Input<string>;
/**
* The maximum amount of time in seconds allowed to complete
* a rotation when a scheduled token rotation occurs. The default rotation window is
* unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
*/
rotationWindow?: pulumi.Input<number>;
/**
* Service Account to impersonate for plugin workload identity federation.
* Required with `identityTokenAudience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
*/
serviceAccountEmail?: pulumi.Input<string>;
/**
* Extra configuration block. Structure is documented below.
*
* The `tune` block is used to tune the auth backend:
*/
tune?: pulumi.Input<inputs.gcp.AuthBackendTune>;
}
/**
* The set of arguments for constructing a AuthBackend resource.
*/
export interface AuthBackendArgs {
/**
* The clients email associated with the credentials
*/
clientEmail?: pulumi.Input<string>;
/**
* The Client ID of the credentials
*/
clientId?: pulumi.Input<string>;
/**
* A JSON string containing the contents of a GCP credentials file. If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running.
*/
credentials?: pulumi.Input<string>;
/**
* Specifies overrides to
* [service endpoints](https://cloud.google.com/apis/design/glossary#api_service_endpoint)
* used when making API requests. This allows specific requests made during authentication
* to target alternative service endpoints for use in [Private Google Access](https://cloud.google.com/vpc/docs/configure-private-google-access)
* environments. Requires Vault 1.11+.
*
* Overrides are set at the subdomain level using the following keys:
*/
customEndpoint?: pulumi.Input<inputs.gcp.AuthBackendCustomEndpoint>;
/**
* A description of the auth method.
*/
description?: pulumi.Input<string>;
/**
* Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
*/
disableAutomatedRotation?: pulumi.Input<boolean>;
/**
* If set, opts out of mount migration on path updates.
* See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
*/
disableRemount?: pulumi.Input<boolean>;
/**
* The audience claim value for plugin identity
* tokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).
* Mutually exclusive with `credentials`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
*/
identityTokenAudience?: pulumi.Input<string>;
/**
* The key to use for signing plugin identity
* tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
*/
identityTokenKey?: pulumi.Input<string>;
/**
* The TTL of generated tokens.
*/
identityTokenTtl?: pulumi.Input<number>;
/**
* Specifies if the auth method is local only.
*/
local?: pulumi.Input<boolean>;
/**
* The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
*/
namespace?: pulumi.Input<string>;
/**
* The path to mount the auth method — this defaults to 'gcp'.
*/
path?: pulumi.Input<string>;
/**
* The ID of the private key from the credentials
*/
privateKeyId?: pulumi.Input<string>;
/**
* The GCP Project ID
*/
projectId?: pulumi.Input<string>;
/**
* The amount of time in seconds Vault should wait before rotating the root credential.
* A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
*/
rotationPeriod?: pulumi.Input<number>;
/**
* The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
* defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
*/
rotationSchedule?: pulumi.Input<string>;
/**
* The maximum amount of time in seconds allowed to complete
* a rotation when a scheduled token rotation occurs. The default rotation window is
* unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
*/
rotationWindow?: pulumi.Input<number>;
/**
* Service Account to impersonate for plugin workload identity federation.
* Required with `identityTokenAudience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
*/
serviceAccountEmail?: pulumi.Input<string>;
/**
* Extra configuration block. Structure is documented below.
*
* The `tune` block is used to tune the auth backend:
*/
tune?: pulumi.Input<inputs.gcp.AuthBackendTune>;
}