@pulumi/vault
Version:
A Pulumi package for creating and managing HashiCorp Vault cloud resources.
332 lines (331 loc) • 12.3 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
/**
* Provides a resource for managing an
* [Okta auth backend within Vault](https://www.vaultproject.io/docs/auth/okta.html).
*
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as vault from "@pulumi/vault";
*
* const example = new vault.okta.AuthBackend("example", {
* description: "Demonstration of the Terraform Okta auth backend",
* organization: "example",
* token: "something that should be kept secret",
* groups: [{
* groupName: "foo",
* policies: [
* "one",
* "two",
* ],
* }],
* users: [{
* username: "bar",
* groups: ["foo"],
* }],
* });
* ```
*
* ## Import
*
* Okta authentication backends can be imported using its `path`, e.g.
*
* ```sh
* $ pulumi import vault:okta/authBackend:AuthBackend example okta
* ```
*/
export declare class AuthBackend extends pulumi.CustomResource {
/**
* Get an existing AuthBackend resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AuthBackendState, opts?: pulumi.CustomResourceOptions): AuthBackend;
/**
* Returns true if the given object is an instance of AuthBackend. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is AuthBackend;
/**
* The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).
*/
readonly accessor: pulumi.Output<string>;
/**
* The Okta url. Examples: oktapreview.com, okta.com
*/
readonly baseUrl: pulumi.Output<string | undefined>;
/**
* When true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.
*/
readonly bypassOktaMfa: pulumi.Output<boolean | undefined>;
/**
* The description of the auth backend
*/
readonly description: pulumi.Output<string | undefined>;
/**
* If set, opts out of mount migration on path updates.
* See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
*/
readonly disableRemount: pulumi.Output<boolean | undefined>;
/**
* Associate Okta groups with policies within Vault.
* See below for more details.
*/
readonly groups: pulumi.Output<outputs.okta.AuthBackendGroup[]>;
/**
* The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
*/
readonly namespace: pulumi.Output<string | undefined>;
/**
* The Okta organization. This will be the first part of the url `https://XXX.okta.com`
*/
readonly organization: pulumi.Output<string>;
/**
* Path to mount the Okta auth backend. Default to path `okta`.
*/
readonly path: pulumi.Output<string | undefined>;
/**
* The Okta API token. This is required to query Okta for user group membership.
* If this is not supplied only locally configured groups will be enabled.
*/
readonly token: pulumi.Output<string | undefined>;
/**
* Specifies the blocks of IP addresses which are allowed to use the generated token
*/
readonly tokenBoundCidrs: pulumi.Output<string[] | undefined>;
/**
* Generated Token's Explicit Maximum TTL in seconds
*/
readonly tokenExplicitMaxTtl: pulumi.Output<number | undefined>;
/**
* The maximum lifetime of the generated token
*/
readonly tokenMaxTtl: pulumi.Output<number | undefined>;
/**
* If true, the 'default' policy will not automatically be added to generated tokens
*/
readonly tokenNoDefaultPolicy: pulumi.Output<boolean | undefined>;
/**
* The maximum number of times a token may be used, a value of zero means unlimited
*/
readonly tokenNumUses: pulumi.Output<number | undefined>;
/**
* Generated Token's Period
*/
readonly tokenPeriod: pulumi.Output<number | undefined>;
/**
* Generated Token's Policies
*/
readonly tokenPolicies: pulumi.Output<string[] | undefined>;
/**
* The initial ttl of the token to generate in seconds
*/
readonly tokenTtl: pulumi.Output<number | undefined>;
/**
* The type of token to generate, service or batch
*/
readonly tokenType: pulumi.Output<string | undefined>;
/**
* Associate Okta users with groups or policies within Vault.
* See below for more details.
*/
readonly users: pulumi.Output<outputs.okta.AuthBackendUser[]>;
/**
* Create a AuthBackend resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: AuthBackendArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering AuthBackend resources.
*/
export interface AuthBackendState {
/**
* The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).
*/
accessor?: pulumi.Input<string>;
/**
* The Okta url. Examples: oktapreview.com, okta.com
*/
baseUrl?: pulumi.Input<string>;
/**
* When true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.
*/
bypassOktaMfa?: pulumi.Input<boolean>;
/**
* The description of the auth backend
*/
description?: pulumi.Input<string>;
/**
* If set, opts out of mount migration on path updates.
* See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
*/
disableRemount?: pulumi.Input<boolean>;
/**
* Associate Okta groups with policies within Vault.
* See below for more details.
*/
groups?: pulumi.Input<pulumi.Input<inputs.okta.AuthBackendGroup>[]>;
/**
* The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
*/
namespace?: pulumi.Input<string>;
/**
* The Okta organization. This will be the first part of the url `https://XXX.okta.com`
*/
organization?: pulumi.Input<string>;
/**
* Path to mount the Okta auth backend. Default to path `okta`.
*/
path?: pulumi.Input<string>;
/**
* The Okta API token. This is required to query Okta for user group membership.
* If this is not supplied only locally configured groups will be enabled.
*/
token?: pulumi.Input<string>;
/**
* Specifies the blocks of IP addresses which are allowed to use the generated token
*/
tokenBoundCidrs?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Generated Token's Explicit Maximum TTL in seconds
*/
tokenExplicitMaxTtl?: pulumi.Input<number>;
/**
* The maximum lifetime of the generated token
*/
tokenMaxTtl?: pulumi.Input<number>;
/**
* If true, the 'default' policy will not automatically be added to generated tokens
*/
tokenNoDefaultPolicy?: pulumi.Input<boolean>;
/**
* The maximum number of times a token may be used, a value of zero means unlimited
*/
tokenNumUses?: pulumi.Input<number>;
/**
* Generated Token's Period
*/
tokenPeriod?: pulumi.Input<number>;
/**
* Generated Token's Policies
*/
tokenPolicies?: pulumi.Input<pulumi.Input<string>[]>;
/**
* The initial ttl of the token to generate in seconds
*/
tokenTtl?: pulumi.Input<number>;
/**
* The type of token to generate, service or batch
*/
tokenType?: pulumi.Input<string>;
/**
* Associate Okta users with groups or policies within Vault.
* See below for more details.
*/
users?: pulumi.Input<pulumi.Input<inputs.okta.AuthBackendUser>[]>;
}
/**
* The set of arguments for constructing a AuthBackend resource.
*/
export interface AuthBackendArgs {
/**
* The Okta url. Examples: oktapreview.com, okta.com
*/
baseUrl?: pulumi.Input<string>;
/**
* When true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.
*/
bypassOktaMfa?: pulumi.Input<boolean>;
/**
* The description of the auth backend
*/
description?: pulumi.Input<string>;
/**
* If set, opts out of mount migration on path updates.
* See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
*/
disableRemount?: pulumi.Input<boolean>;
/**
* Associate Okta groups with policies within Vault.
* See below for more details.
*/
groups?: pulumi.Input<pulumi.Input<inputs.okta.AuthBackendGroup>[]>;
/**
* The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
*/
namespace?: pulumi.Input<string>;
/**
* The Okta organization. This will be the first part of the url `https://XXX.okta.com`
*/
organization: pulumi.Input<string>;
/**
* Path to mount the Okta auth backend. Default to path `okta`.
*/
path?: pulumi.Input<string>;
/**
* The Okta API token. This is required to query Okta for user group membership.
* If this is not supplied only locally configured groups will be enabled.
*/
token?: pulumi.Input<string>;
/**
* Specifies the blocks of IP addresses which are allowed to use the generated token
*/
tokenBoundCidrs?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Generated Token's Explicit Maximum TTL in seconds
*/
tokenExplicitMaxTtl?: pulumi.Input<number>;
/**
* The maximum lifetime of the generated token
*/
tokenMaxTtl?: pulumi.Input<number>;
/**
* If true, the 'default' policy will not automatically be added to generated tokens
*/
tokenNoDefaultPolicy?: pulumi.Input<boolean>;
/**
* The maximum number of times a token may be used, a value of zero means unlimited
*/
tokenNumUses?: pulumi.Input<number>;
/**
* Generated Token's Period
*/
tokenPeriod?: pulumi.Input<number>;
/**
* Generated Token's Policies
*/
tokenPolicies?: pulumi.Input<pulumi.Input<string>[]>;
/**
* The initial ttl of the token to generate in seconds
*/
tokenTtl?: pulumi.Input<number>;
/**
* The type of token to generate, service or batch
*/
tokenType?: pulumi.Input<string>;
/**
* Associate Okta users with groups or policies within Vault.
* See below for more details.
*/
users?: pulumi.Input<pulumi.Input<inputs.okta.AuthBackendUser>[]>;
}