ApplicationCredential

Manages a V3 Application Credential resource within OpenStack Keystone.

Note: All arguments including the application credential name and secret will be stored in the raw state as plain-text. Read more about sensitive data in state.
Note: An Application Credential is created within the authenticated user project scope and is not visible by an admin or other accounts. The Application Credential visibility is similar to openstack.compute.Keypair.

Example Usage

Predefined secret

using Pulumi;
using OpenStack = Pulumi.OpenStack;

class MyStack : Stack
{
    public MyStack()
    {
        var swift = new OpenStack.Identity.ApplicationCredential("swift", new OpenStack.Identity.ApplicationCredentialArgs
        {
            Description = "Swift technical application credential",
            ExpiresAt = "2019-02-13T12:12:12Z",
            Roles = 
            {
                "swiftoperator",
            },
            Secret = "supersecret",
        });
    }

}

Coming soon!

import pulumi
import pulumi_openstack as openstack

swift = openstack.identity.ApplicationCredential("swift",
    description="Swift technical application credential",
    expires_at="2019-02-13T12:12:12Z",
    roles=["swiftoperator"],
    secret="supersecret")

import * as pulumi from "@pulumi/pulumi";
import * as openstack from "@pulumi/openstack";

const swift = new openstack.identity.ApplicationCredential("swift", {
    description: "Swift technical application credential",
    expiresAt: "2019-02-13T12:12:12Z",
    roles: ["swiftoperator"],
    secret: "supersecret",
});

Unrestricted with autogenerated secret and unlimited TTL

using Pulumi;
using OpenStack = Pulumi.OpenStack;

class MyStack : Stack
{
    public MyStack()
    {
        var unrestricted = new OpenStack.Identity.ApplicationCredential("unrestricted", new OpenStack.Identity.ApplicationCredentialArgs
        {
            Description = "Unrestricted application credential",
            Unrestricted = true,
        });
        this.ApplicationCredentialSecret = unrestricted.Secret;
    }

    [Output("applicationCredentialSecret")]
    public Output<string> ApplicationCredentialSecret { get; set; }
}

Coming soon!

import pulumi
import pulumi_openstack as openstack

unrestricted = openstack.identity.ApplicationCredential("unrestricted",
    description="Unrestricted application credential",
    unrestricted=True)
pulumi.export("applicationCredentialSecret", unrestricted.secret)

import * as pulumi from "@pulumi/pulumi";
import * as openstack from "@pulumi/openstack";

const unrestricted = new openstack.identity.ApplicationCredential("unrestricted", {
    description: "Unrestricted application credential",
    unrestricted: true,
});

export const applicationCredentialSecret = unrestricted.secret;

Application credential with access rules

using Pulumi;
using OpenStack = Pulumi.OpenStack;

class MyStack : Stack
{
    public MyStack()
    {
        var monitoring = new OpenStack.Identity.ApplicationCredential("monitoring", new OpenStack.Identity.ApplicationCredentialArgs
        {
            AccessRules = 
            {
                new OpenStack.Identity.Inputs.ApplicationCredentialAccessRuleArgs
                {
                    Method = "GET",
                    Path = "/v2.0/metrics",
                    Service = "monitoring",
                },
                new OpenStack.Identity.Inputs.ApplicationCredentialAccessRuleArgs
                {
                    Method = "PUT",
                    Path = "/v2.0/metrics",
                    Service = "monitoring",
                },
            },
            ExpiresAt = "2019-02-13T12:12:12Z",
        });
    }

}

Coming soon!

import pulumi
import pulumi_openstack as openstack

monitoring = openstack.identity.ApplicationCredential("monitoring",
    access_rules=[
        {
            "method": "GET",
            "path": "/v2.0/metrics",
            "service": "monitoring",
        },
        {
            "method": "PUT",
            "path": "/v2.0/metrics",
            "service": "monitoring",
        },
    ],
    expires_at="2019-02-13T12:12:12Z")

import * as pulumi from "@pulumi/pulumi";
import * as openstack from "@pulumi/openstack";

const monitoring = new openstack.identity.ApplicationCredential("monitoring", {
    accessRules: [
        {
            method: "GET",
            path: "/v2.0/metrics",
            service: "monitoring",
        },
        {
            method: "PUT",
            path: "/v2.0/metrics",
            service: "monitoring",
        },
    ],
    expiresAt: "2019-02-13T12:12:12Z",
});

Create a ApplicationCredential Resource

new ApplicationCredential(name: string, args?: ApplicationCredentialArgs, opts?: CustomResourceOptions);

def ApplicationCredential(resource_name, opts=None, access_rules=None, description=None, expires_at=None, name=None, region=None, roles=None, secret=None, unrestricted=None, __props__=None);

func NewApplicationCredential(ctx *Context, name string, args *ApplicationCredentialArgs, opts ...ResourceOption) (*ApplicationCredential, error)

public ApplicationCredential(string name, ApplicationCredentialArgs? args = null, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args ApplicationCredentialArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args ApplicationCredentialArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args ApplicationCredentialArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

ApplicationCredential Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The ApplicationCredential resource accepts the following input properties:

AccessRules List<Pulumi.OpenStack.Identity.Inputs.ApplicationCredentialAccessRuleArgs>: A collection of one or more access rules, which this application credential allows to follow. The structure is described below. Changing this creates a new application credential.
Description string: A description of the application credential. Changing this creates a new application credential.
ExpiresAt string: The expiration time of the application credential in the RFC3339 timestamp format (e.g. 2019-03-09T12:58:49Z). If omitted, an application credential will never expire. Changing this creates a new application credential.
Name string: A name of the application credential. Changing this creates a new application credential.
Region string: The region in which to obtain the V3 Keystone client. If omitted, the region argument of the provider is used. Changing this creates a new application credential.
Roles List<string>: A collection of one or more role names, which this application credential has to be associated with its project. If omitted, all the current user’s roles within the scoped project will be inherited by a new application credential. Changing this creates a new application credential.
Secret string: The secret for the application credential. If omitted, it will be generated by the server. Changing this creates a new application credential.
Unrestricted bool: A flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts. Changing this creates a new application credential.

AccessRules []ApplicationCredentialAccessRule: A collection of one or more access rules, which this application credential allows to follow. The structure is described below. Changing this creates a new application credential.
Description string: A description of the application credential. Changing this creates a new application credential.
ExpiresAt string: The expiration time of the application credential in the RFC3339 timestamp format (e.g. 2019-03-09T12:58:49Z). If omitted, an application credential will never expire. Changing this creates a new application credential.
Name string: A name of the application credential. Changing this creates a new application credential.
Region string: The region in which to obtain the V3 Keystone client. If omitted, the region argument of the provider is used. Changing this creates a new application credential.
Roles []string: A collection of one or more role names, which this application credential has to be associated with its project. If omitted, all the current user’s roles within the scoped project will be inherited by a new application credential. Changing this creates a new application credential.
Secret string: The secret for the application credential. If omitted, it will be generated by the server. Changing this creates a new application credential.
Unrestricted bool: A flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts. Changing this creates a new application credential.

accessRules ApplicationCredentialAccessRule[]: A collection of one or more access rules, which this application credential allows to follow. The structure is described below. Changing this creates a new application credential.
description string: A description of the application credential. Changing this creates a new application credential.
expiresAt string: The expiration time of the application credential in the RFC3339 timestamp format (e.g. 2019-03-09T12:58:49Z). If omitted, an application credential will never expire. Changing this creates a new application credential.
name string: A name of the application credential. Changing this creates a new application credential.
region string: The region in which to obtain the V3 Keystone client. If omitted, the region argument of the provider is used. Changing this creates a new application credential.
roles string[]: A collection of one or more role names, which this application credential has to be associated with its project. If omitted, all the current user’s roles within the scoped project will be inherited by a new application credential. Changing this creates a new application credential.
secret string: The secret for the application credential. If omitted, it will be generated by the server. Changing this creates a new application credential.
unrestricted boolean: A flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts. Changing this creates a new application credential.

access_rules List[ApplicationCredentialAccessRule]: A collection of one or more access rules, which this application credential allows to follow. The structure is described below. Changing this creates a new application credential.
description str: A description of the application credential. Changing this creates a new application credential.
expires_at str: The expiration time of the application credential in the RFC3339 timestamp format (e.g. 2019-03-09T12:58:49Z). If omitted, an application credential will never expire. Changing this creates a new application credential.
name str: A name of the application credential. Changing this creates a new application credential.
region str: The region in which to obtain the V3 Keystone client. If omitted, the region argument of the provider is used. Changing this creates a new application credential.
roles List[str]: A collection of one or more role names, which this application credential has to be associated with its project. If omitted, all the current user’s roles within the scoped project will be inherited by a new application credential. Changing this creates a new application credential.
secret str: The secret for the application credential. If omitted, it will be generated by the server. Changing this creates a new application credential.
unrestricted bool: A flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts. Changing this creates a new application credential.

Outputs

All input properties are implicitly available as output properties. Additionally, the ApplicationCredential resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.
ProjectId string: The ID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.

Id string: The provider-assigned unique ID for this managed resource.
ProjectId string: The ID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.

id string: The provider-assigned unique ID for this managed resource.
projectId string: The ID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.

id str: The provider-assigned unique ID for this managed resource.
project_id str: The ID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.

Look up an Existing ApplicationCredential Resource

Get an existing ApplicationCredential resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: ApplicationCredentialState, opts?: CustomResourceOptions): ApplicationCredential

static get(resource_name, id, opts=None, access_rules=None, description=None, expires_at=None, name=None, project_id=None, region=None, roles=None, secret=None, unrestricted=None, __props__=None);

func GetApplicationCredential(ctx *Context, name string, id IDInput, state *ApplicationCredentialState, opts ...ResourceOption) (*ApplicationCredential, error)

public static ApplicationCredential Get(string name, Input<string> id, ApplicationCredentialState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AccessRules List<Pulumi.OpenStack.Identity.Inputs.ApplicationCredentialAccessRuleArgs>: A collection of one or more access rules, which this application credential allows to follow. The structure is described below. Changing this creates a new application credential.
Description string: A description of the application credential. Changing this creates a new application credential.
ExpiresAt string: The expiration time of the application credential in the RFC3339 timestamp format (e.g. 2019-03-09T12:58:49Z). If omitted, an application credential will never expire. Changing this creates a new application credential.
Name string: A name of the application credential. Changing this creates a new application credential.
ProjectId string: The ID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.
Region string: The region in which to obtain the V3 Keystone client. If omitted, the region argument of the provider is used. Changing this creates a new application credential.
Roles List<string>: A collection of one or more role names, which this application credential has to be associated with its project. If omitted, all the current user’s roles within the scoped project will be inherited by a new application credential. Changing this creates a new application credential.
Secret string: The secret for the application credential. If omitted, it will be generated by the server. Changing this creates a new application credential.
Unrestricted bool: A flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts. Changing this creates a new application credential.

AccessRules []ApplicationCredentialAccessRule: A collection of one or more access rules, which this application credential allows to follow. The structure is described below. Changing this creates a new application credential.
Description string: A description of the application credential. Changing this creates a new application credential.
ExpiresAt string: The expiration time of the application credential in the RFC3339 timestamp format (e.g. 2019-03-09T12:58:49Z). If omitted, an application credential will never expire. Changing this creates a new application credential.
Name string: A name of the application credential. Changing this creates a new application credential.
ProjectId string: The ID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.
Region string: The region in which to obtain the V3 Keystone client. If omitted, the region argument of the provider is used. Changing this creates a new application credential.
Roles []string: A collection of one or more role names, which this application credential has to be associated with its project. If omitted, all the current user’s roles within the scoped project will be inherited by a new application credential. Changing this creates a new application credential.
Secret string: The secret for the application credential. If omitted, it will be generated by the server. Changing this creates a new application credential.
Unrestricted bool: A flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts. Changing this creates a new application credential.

accessRules ApplicationCredentialAccessRule[]: A collection of one or more access rules, which this application credential allows to follow. The structure is described below. Changing this creates a new application credential.
description string: A description of the application credential. Changing this creates a new application credential.
expiresAt string: The expiration time of the application credential in the RFC3339 timestamp format (e.g. 2019-03-09T12:58:49Z). If omitted, an application credential will never expire. Changing this creates a new application credential.
name string: A name of the application credential. Changing this creates a new application credential.
projectId string: The ID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.
region string: The region in which to obtain the V3 Keystone client. If omitted, the region argument of the provider is used. Changing this creates a new application credential.
roles string[]: A collection of one or more role names, which this application credential has to be associated with its project. If omitted, all the current user’s roles within the scoped project will be inherited by a new application credential. Changing this creates a new application credential.
secret string: The secret for the application credential. If omitted, it will be generated by the server. Changing this creates a new application credential.
unrestricted boolean: A flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts. Changing this creates a new application credential.

access_rules List[ApplicationCredentialAccessRule]: A collection of one or more access rules, which this application credential allows to follow. The structure is described below. Changing this creates a new application credential.
description str: A description of the application credential. Changing this creates a new application credential.
expires_at str: The expiration time of the application credential in the RFC3339 timestamp format (e.g. 2019-03-09T12:58:49Z). If omitted, an application credential will never expire. Changing this creates a new application credential.
name str: A name of the application credential. Changing this creates a new application credential.
project_id str: The ID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.
region str: The region in which to obtain the V3 Keystone client. If omitted, the region argument of the provider is used. Changing this creates a new application credential.
roles List[str]: A collection of one or more role names, which this application credential has to be associated with its project. If omitted, all the current user’s roles within the scoped project will be inherited by a new application credential. Changing this creates a new application credential.
secret str: The secret for the application credential. If omitted, it will be generated by the server. Changing this creates a new application credential.
unrestricted bool: A flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts. Changing this creates a new application credential.

Supporting Types

ApplicationCredentialAccessRule

See the input and output API doc for this type.

Method string: The request method that the application credential is permitted to use for a given API endpoint. Allowed values: POST, GET, HEAD, PATCH, PUT and DELETE.
Path string: The API path that the application credential is permitted to access. May use named wildcards such as {tag} or the unnamed wildcard * to match against any string in the path up to a /, or the recursive wildcard ** to include / in the matched path.
Service string: The service type identifier for the service that the application credential is granted to access. Must be a service type that is listed in the service catalog and not a code name for a service. E.g. identity, compute, volumev3, image, network, object-store, sharev2, dns, key-manager, monitoring, etc.
Id string: The ID of the existing access rule. The access rule ID of another application credential can be provided.

Method string: The request method that the application credential is permitted to use for a given API endpoint. Allowed values: POST, GET, HEAD, PATCH, PUT and DELETE.
Path string: The API path that the application credential is permitted to access. May use named wildcards such as {tag} or the unnamed wildcard * to match against any string in the path up to a /, or the recursive wildcard ** to include / in the matched path.
Service string: The service type identifier for the service that the application credential is granted to access. Must be a service type that is listed in the service catalog and not a code name for a service. E.g. identity, compute, volumev3, image, network, object-store, sharev2, dns, key-manager, monitoring, etc.
Id string: The ID of the existing access rule. The access rule ID of another application credential can be provided.

method string: The request method that the application credential is permitted to use for a given API endpoint. Allowed values: POST, GET, HEAD, PATCH, PUT and DELETE.
path string: The API path that the application credential is permitted to access. May use named wildcards such as {tag} or the unnamed wildcard * to match against any string in the path up to a /, or the recursive wildcard ** to include / in the matched path.
service string: The service type identifier for the service that the application credential is granted to access. Must be a service type that is listed in the service catalog and not a code name for a service. E.g. identity, compute, volumev3, image, network, object-store, sharev2, dns, key-manager, monitoring, etc.
id string: The ID of the existing access rule. The access rule ID of another application credential can be provided.

method str: The request method that the application credential is permitted to use for a given API endpoint. Allowed values: POST, GET, HEAD, PATCH, PUT and DELETE.
path str: The API path that the application credential is permitted to access. May use named wildcards such as {tag} or the unnamed wildcard * to match against any string in the path up to a /, or the recursive wildcard ** to include / in the matched path.
service str: The service type identifier for the service that the application credential is granted to access. Must be a service type that is listed in the service catalog and not a code name for a service. E.g. identity, compute, volumev3, image, network, object-store, sharev2, dns, key-manager, monitoring, etc.
id str: The ID of the existing access rule. The access rule ID of another application credential can be provided.

Package Details

Repository: https://github.com/pulumi/pulumi-openstack
License: Apache-2.0
Notes: This Pulumi package is based on the openstack Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud

ApplicationCredential

Example Usage

Predefined secret

Unrestricted with autogenerated secret and unlimited TTL

Application credential with access rules

Create a ApplicationCredential Resource

ApplicationCredential Resource Properties

Inputs

Outputs

Look up an Existing ApplicationCredential Resource

Supporting Types

ApplicationCredentialAccessRule

Package Details

On This Page