@pulumi/vault/github/authBackend.d.ts

A Pulumi package for creating and managing HashiCorp Vault cloud resources.

import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
 * Manages a GitHub Auth mount in a Vault server. See the [Vault
 * documentation](https://www.vaultproject.io/docs/auth/github/) for more
 * information.
 *
 * ## Example Usage
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as vault from "@pulumi/vault";
 *
 * const example = new vault.github.AuthBackend("example", {organization: "myorg"});
 * ```
 *
 * ## Import
 *
 * GitHub authentication mounts can be imported using the `path`, e.g.
 *
 * ```sh
 * $ pulumi import vault:github/authBackend:AuthBackend example github
 * ```
 */
export declare class AuthBackend extends pulumi.CustomResource {
    /**
     * Get an existing AuthBackend resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AuthBackendState, opts?: pulumi.CustomResourceOptions): AuthBackend;
    /**
     * Returns true if the given object is an instance of AuthBackend.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is AuthBackend;
    /**
     * The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).
     */
    readonly accessor: pulumi.Output<string>;
    /**
     * The API endpoint to use. Useful if you
     * are running GitHub Enterprise or an API-compatible authentication server.
     */
    readonly baseUrl: pulumi.Output<string | undefined>;
    /**
     * Specifies the description of the mount.
     * This overrides the current stored value, if any.
     */
    readonly description: pulumi.Output<string | undefined>;
    /**
     * If set, opts out of mount migration on path updates.
     * See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
     */
    readonly disableRemount: pulumi.Output<boolean | undefined>;
    /**
     * The namespace to provision the resource in.
     * The value should not contain leading or trailing forward slashes.
     * The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
     * *Available only for Vault Enterprise*.
     */
    readonly namespace: pulumi.Output<string | undefined>;
    /**
     * The organization configured users must be part of.
     */
    readonly organization: pulumi.Output<string>;
    /**
     * The ID of the organization users must be part of.
     * Vault will attempt to fetch and set this value if it is not provided. (Vault 1.10+)
     */
    readonly organizationId: pulumi.Output<number>;
    /**
     * Path where the auth backend is mounted. Defaults to `auth/github`
     * if not specified.
     */
    readonly path: pulumi.Output<string | undefined>;
    /**
     * (Optional) List of CIDR blocks; if set, specifies blocks of IP
     * addresses which can authenticate successfully, and ties the resulting token to these blocks
     * as well.
     */
    readonly tokenBoundCidrs: pulumi.Output<string[] | undefined>;
    /**
     * (Optional) If set, will encode an
     * [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
     * onto the token in number of seconds. This is a hard cap even if `tokenTtl` and
     * `tokenMaxTtl` would otherwise allow a renewal.
     */
    readonly tokenExplicitMaxTtl: pulumi.Output<number | undefined>;
    /**
     * (Optional) The maximum lifetime for generated tokens in number of seconds.
     * Its current value will be referenced at renewal time.
     */
    readonly tokenMaxTtl: pulumi.Output<number | undefined>;
    /**
     * (Optional) If set, the default policy will not be set on
     * generated tokens; otherwise it will be added to the policies set in token_policies.
     */
    readonly tokenNoDefaultPolicy: pulumi.Output<boolean | undefined>;
    /**
     * (Optional) The [maximum number](https://www.vaultproject.io/api-docs/github#token_num_uses)
     * of times a generated token may be used (within its lifetime); 0 means unlimited.
     */
    readonly tokenNumUses: pulumi.Output<number | undefined>;
    /**
     * (Optional) If set, indicates that the
     * token generated using this role should never expire. The token should be renewed within the
     * duration specified by this value. At each renewal, the token's TTL will be set to the
     * value of this field. Specified in seconds.
     */
    readonly tokenPeriod: pulumi.Output<number | undefined>;
    /**
     * (Optional) List of policies to encode onto generated tokens. Depending
     * on the auth method, this list may be supplemented by user/group/other values.
     */
    readonly tokenPolicies: pulumi.Output<string[] | undefined>;
    /**
     * (Optional) The incremental lifetime for generated tokens in number of seconds.
     * Its current value will be referenced at renewal time.
     */
    readonly tokenTtl: pulumi.Output<number | undefined>;
    /**
     * Specifies the type of tokens that should be returned by
     * the mount. Valid values are "default-service", "default-batch", "service", "batch".
     */
    readonly tokenType: pulumi.Output<string | undefined>;
    /**
     * Extra configuration block. Structure is documented below.
     *
     * The `tune` block is used to tune the auth backend:
     */
    readonly tune: pulumi.Output<outputs.github.AuthBackendTune>;
    /**
     * Create a AuthBackend resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args: AuthBackendArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering AuthBackend resources.
 */
export interface AuthBackendState {
    /**
     * The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).
     */
    accessor?: pulumi.Input<string>;
    /**
     * The API endpoint to use. Useful if you
     * are running GitHub Enterprise or an API-compatible authentication server.
     */
    baseUrl?: pulumi.Input<string>;
    /**
     * Specifies the description of the mount.
     * This overrides the current stored value, if any.
     */
    description?: pulumi.Input<string>;
    /**
     * If set, opts out of mount migration on path updates.
     * See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
     */
    disableRemount?: pulumi.Input<boolean>;
    /**
     * The namespace to provision the resource in.
     * The value should not contain leading or trailing forward slashes.
     * The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
     * *Available only for Vault Enterprise*.
     */
    namespace?: pulumi.Input<string>;
    /**
     * The organization configured users must be part of.
     */
    organization?: pulumi.Input<string>;
    /**
     * The ID of the organization users must be part of.
     * Vault will attempt to fetch and set this value if it is not provided. (Vault 1.10+)
     */
    organizationId?: pulumi.Input<number>;
    /**
     * Path where the auth backend is mounted. Defaults to `auth/github`
     * if not specified.
     */
    path?: pulumi.Input<string>;
    /**
     * (Optional) List of CIDR blocks; if set, specifies blocks of IP
     * addresses which can authenticate successfully, and ties the resulting token to these blocks
     * as well.
     */
    tokenBoundCidrs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * (Optional) If set, will encode an
     * [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
     * onto the token in number of seconds. This is a hard cap even if `tokenTtl` and
     * `tokenMaxTtl` would otherwise allow a renewal.
     */
    tokenExplicitMaxTtl?: pulumi.Input<number>;
    /**
     * (Optional) The maximum lifetime for generated tokens in number of seconds.
     * Its current value will be referenced at renewal time.
     */
    tokenMaxTtl?: pulumi.Input<number>;
    /**
     * (Optional) If set, the default policy will not be set on
     * generated tokens; otherwise it will be added to the policies set in token_policies.
     */
    tokenNoDefaultPolicy?: pulumi.Input<boolean>;
    /**
     * (Optional) The [maximum number](https://www.vaultproject.io/api-docs/github#token_num_uses)
     * of times a generated token may be used (within its lifetime); 0 means unlimited.
     */
    tokenNumUses?: pulumi.Input<number>;
    /**
     * (Optional) If set, indicates that the
     * token generated using this role should never expire. The token should be renewed within the
     * duration specified by this value. At each renewal, the token's TTL will be set to the
     * value of this field. Specified in seconds.
     */
    tokenPeriod?: pulumi.Input<number>;
    /**
     * (Optional) List of policies to encode onto generated tokens. Depending
     * on the auth method, this list may be supplemented by user/group/other values.
     */
    tokenPolicies?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * (Optional) The incremental lifetime for generated tokens in number of seconds.
     * Its current value will be referenced at renewal time.
     */
    tokenTtl?: pulumi.Input<number>;
    /**
     * Specifies the type of tokens that should be returned by
     * the mount. Valid values are "default-service", "default-batch", "service", "batch".
     */
    tokenType?: pulumi.Input<string>;
    /**
     * Extra configuration block. Structure is documented below.
     *
     * The `tune` block is used to tune the auth backend:
     */
    tune?: pulumi.Input<inputs.github.AuthBackendTune>;
}
/**
 * The set of arguments for constructing a AuthBackend resource.
 */
export interface AuthBackendArgs {
    /**
     * The API endpoint to use. Useful if you
     * are running GitHub Enterprise or an API-compatible authentication server.
     */
    baseUrl?: pulumi.Input<string>;
    /**
     * Specifies the description of the mount.
     * This overrides the current stored value, if any.
     */
    description?: pulumi.Input<string>;
    /**
     * If set, opts out of mount migration on path updates.
     * See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
     */
    disableRemount?: pulumi.Input<boolean>;
    /**
     * The namespace to provision the resource in.
     * The value should not contain leading or trailing forward slashes.
     * The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
     * *Available only for Vault Enterprise*.
     */
    namespace?: pulumi.Input<string>;
    /**
     * The organization configured users must be part of.
     */
    organization: pulumi.Input<string>;
    /**
     * The ID of the organization users must be part of.
     * Vault will attempt to fetch and set this value if it is not provided. (Vault 1.10+)
     */
    organizationId?: pulumi.Input<number>;
    /**
     * Path where the auth backend is mounted. Defaults to `auth/github`
     * if not specified.
     */
    path?: pulumi.Input<string>;
    /**
     * (Optional) List of CIDR blocks; if set, specifies blocks of IP
     * addresses which can authenticate successfully, and ties the resulting token to these blocks
     * as well.
     */
    tokenBoundCidrs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * (Optional) If set, will encode an
     * [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
     * onto the token in number of seconds. This is a hard cap even if `tokenTtl` and
     * `tokenMaxTtl` would otherwise allow a renewal.
     */
    tokenExplicitMaxTtl?: pulumi.Input<number>;
    /**
     * (Optional) The maximum lifetime for generated tokens in number of seconds.
     * Its current value will be referenced at renewal time.
     */
    tokenMaxTtl?: pulumi.Input<number>;
    /**
     * (Optional) If set, the default policy will not be set on
     * generated tokens; otherwise it will be added to the policies set in token_policies.
     */
    tokenNoDefaultPolicy?: pulumi.Input<boolean>;
    /**
     * (Optional) The [maximum number](https://www.vaultproject.io/api-docs/github#token_num_uses)
     * of times a generated token may be used (within its lifetime); 0 means unlimited.
     */
    tokenNumUses?: pulumi.Input<number>;
    /**
     * (Optional) If set, indicates that the
     * token generated using this role should never expire. The token should be renewed within the
     * duration specified by this value. At each renewal, the token's TTL will be set to the
     * value of this field. Specified in seconds.
     */
    tokenPeriod?: pulumi.Input<number>;
    /**
     * (Optional) List of policies to encode onto generated tokens. Depending
     * on the auth method, this list may be supplemented by user/group/other values.
     */
    tokenPolicies?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * (Optional) The incremental lifetime for generated tokens in number of seconds.
     * Its current value will be referenced at renewal time.
     */
    tokenTtl?: pulumi.Input<number>;
    /**
     * Specifies the type of tokens that should be returned by
     * the mount. Valid values are "default-service", "default-batch", "service", "batch".
     */
    tokenType?: pulumi.Input<string>;
    /**
     * Extra configuration block. Structure is documented below.
     *
     * The `tune` block is used to tune the auth backend:
     */
    tune?: pulumi.Input<inputs.github.AuthBackendTune>;
}