@pulumi/vault
Version:
A Pulumi package for creating and managing HashiCorp Vault cloud resources.
280 lines (279 loc) • 10.7 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
/**
* Creates an Identity Group for Vault. The [Identity secrets engine](https://www.vaultproject.io/docs/secrets/identity/index.html) is the identity management solution for Vault.
*
* A group can contain multiple entities as its members. A group can also have subgroups. Policies set on the group is granted to all members of the group. During request time, when the token's entity ID is being evaluated for the policies that it has access to; along with the policies on the entity itself, policies that are inherited due to group memberships are also granted.
*
* ## Example Usage
*
* ### Internal Group
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as vault from "@pulumi/vault";
*
* const internal = new vault.identity.Group("internal", {
* name: "internal",
* type: "internal",
* policies: [
* "dev",
* "test",
* ],
* metadata: {
* version: "2",
* },
* });
* ```
*
* ### External Group
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as vault from "@pulumi/vault";
*
* const group = new vault.identity.Group("group", {
* name: "external",
* type: "external",
* policies: ["test"],
* metadata: {
* version: "1",
* },
* });
* ```
*
* ## Caveats
*
* It's important to note that Vault identity groups names are *case-insensitive*. For example the following resources would be equivalent.
* Applying this configuration would result in the provider failing to create one of the identity groups, since the resources share the same `name`.
*
* This sort of pattern should be avoided:
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as vault from "@pulumi/vault";
*
* const internal = new vault.identity.Group("internal", {
* name: "internal",
* type: "internal",
* policies: [
* "dev",
* "test",
* ],
* metadata: {
* version: "2",
* },
* });
* const internalGroup = new vault.identity.Group("Internal", {
* name: "Internal",
* type: "internal",
* policies: [
* "dev",
* "test",
* ],
* metadata: {
* version: "2",
* },
* });
* ```
*
* ## Import
*
* Identity group can be imported using the `id`, e.g.
*
* ```sh
* $ pulumi import vault:identity/group:Group test 'fcbf1efb-2b69-4209-bed8-811e3475dad3'
* ```
*/
export declare class Group extends pulumi.CustomResource {
/**
* Get an existing Group resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: GroupState, opts?: pulumi.CustomResourceOptions): Group;
/**
* Returns true if the given object is an instance of Group. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is Group;
/**
* `false` by default. If set to `true`, this resource will ignore any Entity IDs
* returned from Vault or specified in the resource. You can use
* `vault.identity.GroupMemberEntityIds` to manage Entity IDs for this group in a
* decoupled manner.
*/
readonly externalMemberEntityIds: pulumi.Output<boolean | undefined>;
/**
* `false` by default. If set to `true`, this resource will ignore any Group IDs
* returned from Vault or specified in the resource. You can use
* `vault.identity.GroupMemberGroupIds` to manage Group IDs for this group in a
* decoupled manner.
*/
readonly externalMemberGroupIds: pulumi.Output<boolean | undefined>;
/**
* `false` by default. If set to `true`, this resource will ignore any policies returned from
* Vault or specified in the resource. You can use `vault.identity.GroupPolicies` to manage
* policies for this group in a decoupled manner.
*/
readonly externalPolicies: pulumi.Output<boolean | undefined>;
/**
* A list of Entity IDs to be assigned as group members. Not allowed on `external` groups.
*/
readonly memberEntityIds: pulumi.Output<string[] | undefined>;
/**
* A list of Group IDs to be assigned as group members. Not allowed on `external` groups.
*/
readonly memberGroupIds: pulumi.Output<string[] | undefined>;
/**
* A Map of additional metadata to associate with the group.
*/
readonly metadata: pulumi.Output<{
[key: string]: string;
} | undefined>;
/**
* Name of the identity group to create.
*/
readonly name: pulumi.Output<string>;
/**
* The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
*/
readonly namespace: pulumi.Output<string | undefined>;
/**
* A list of policies to apply to the group.
*/
readonly policies: pulumi.Output<string[] | undefined>;
/**
* Type of the group, internal or external. Defaults to `internal`.
*/
readonly type: pulumi.Output<string | undefined>;
/**
* Create a Group resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args?: GroupArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering Group resources.
*/
export interface GroupState {
/**
* `false` by default. If set to `true`, this resource will ignore any Entity IDs
* returned from Vault or specified in the resource. You can use
* `vault.identity.GroupMemberEntityIds` to manage Entity IDs for this group in a
* decoupled manner.
*/
externalMemberEntityIds?: pulumi.Input<boolean>;
/**
* `false` by default. If set to `true`, this resource will ignore any Group IDs
* returned from Vault or specified in the resource. You can use
* `vault.identity.GroupMemberGroupIds` to manage Group IDs for this group in a
* decoupled manner.
*/
externalMemberGroupIds?: pulumi.Input<boolean>;
/**
* `false` by default. If set to `true`, this resource will ignore any policies returned from
* Vault or specified in the resource. You can use `vault.identity.GroupPolicies` to manage
* policies for this group in a decoupled manner.
*/
externalPolicies?: pulumi.Input<boolean>;
/**
* A list of Entity IDs to be assigned as group members. Not allowed on `external` groups.
*/
memberEntityIds?: pulumi.Input<pulumi.Input<string>[]>;
/**
* A list of Group IDs to be assigned as group members. Not allowed on `external` groups.
*/
memberGroupIds?: pulumi.Input<pulumi.Input<string>[]>;
/**
* A Map of additional metadata to associate with the group.
*/
metadata?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* Name of the identity group to create.
*/
name?: pulumi.Input<string>;
/**
* The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
*/
namespace?: pulumi.Input<string>;
/**
* A list of policies to apply to the group.
*/
policies?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Type of the group, internal or external. Defaults to `internal`.
*/
type?: pulumi.Input<string>;
}
/**
* The set of arguments for constructing a Group resource.
*/
export interface GroupArgs {
/**
* `false` by default. If set to `true`, this resource will ignore any Entity IDs
* returned from Vault or specified in the resource. You can use
* `vault.identity.GroupMemberEntityIds` to manage Entity IDs for this group in a
* decoupled manner.
*/
externalMemberEntityIds?: pulumi.Input<boolean>;
/**
* `false` by default. If set to `true`, this resource will ignore any Group IDs
* returned from Vault or specified in the resource. You can use
* `vault.identity.GroupMemberGroupIds` to manage Group IDs for this group in a
* decoupled manner.
*/
externalMemberGroupIds?: pulumi.Input<boolean>;
/**
* `false` by default. If set to `true`, this resource will ignore any policies returned from
* Vault or specified in the resource. You can use `vault.identity.GroupPolicies` to manage
* policies for this group in a decoupled manner.
*/
externalPolicies?: pulumi.Input<boolean>;
/**
* A list of Entity IDs to be assigned as group members. Not allowed on `external` groups.
*/
memberEntityIds?: pulumi.Input<pulumi.Input<string>[]>;
/**
* A list of Group IDs to be assigned as group members. Not allowed on `external` groups.
*/
memberGroupIds?: pulumi.Input<pulumi.Input<string>[]>;
/**
* A Map of additional metadata to associate with the group.
*/
metadata?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* Name of the identity group to create.
*/
name?: pulumi.Input<string>;
/**
* The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
*/
namespace?: pulumi.Input<string>;
/**
* A list of policies to apply to the group.
*/
policies?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Type of the group, internal or external. Defaults to `internal`.
*/
type?: pulumi.Input<string>;
}