CertAuthBackendRole

Provides a resource to create a role in an Cert auth backend within Vault.

Example Usage

using System.IO;
using Pulumi;
using Vault = Pulumi.Vault;

class MyStack : Stack
{
    public MyStack()
    {
        var certAuthBackend = new Vault.AuthBackend("certAuthBackend", new Vault.AuthBackendArgs
        {
            Path = "cert",
            Type = "cert",
        });
        var certCertAuthBackendRole = new Vault.CertAuthBackendRole("certCertAuthBackendRole", new Vault.CertAuthBackendRoleArgs
        {
            Certificate = File.ReadAllText("/path/to/certs/ca-cert.pem"),
            Backend = certAuthBackend.Path,
            AllowedNames = 
            {
                "foo.example.org",
                "baz.example.org",
            },
            TokenTtl = 300,
            TokenMaxTtl = 600,
            TokenPolicies = 
            {
                "foo",
            },
        });
    }

}

Coming soon!

import pulumi
import pulumi_vault as vault

cert_auth_backend = vault.AuthBackend("certAuthBackend",
    path="cert",
    type="cert")
cert_cert_auth_backend_role = vault.CertAuthBackendRole("certCertAuthBackendRole",
    certificate=(lambda path: open(path).read())("/path/to/certs/ca-cert.pem"),
    backend=cert_auth_backend.path,
    allowed_names=[
        "foo.example.org",
        "baz.example.org",
    ],
    token_ttl=300,
    token_max_ttl=600,
    token_policies=["foo"])

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
import * from "fs";

const certAuthBackend = new vault.AuthBackend("certAuthBackend", {
    path: "cert",
    type: "cert",
});
const certCertAuthBackendRole = new vault.CertAuthBackendRole("certCertAuthBackendRole", {
    certificate: fs.readFileSync("/path/to/certs/ca-cert.pem"),
    backend: certAuthBackend.path,
    allowedNames: [
        "foo.example.org",
        "baz.example.org",
    ],
    tokenTtl: 300,
    tokenMaxTtl: 600,
    tokenPolicies: ["foo"],
});

Create a CertAuthBackendRole Resource

new CertAuthBackendRole(name: string, args: CertAuthBackendRoleArgs, opts?: CustomResourceOptions);

def CertAuthBackendRole(resource_name, opts=None, allowed_common_names=None, allowed_dns_sans=None, allowed_email_sans=None, allowed_names=None, allowed_organization_units=None, allowed_uri_sans=None, backend=None, bound_cidrs=None, certificate=None, display_name=None, max_ttl=None, name=None, period=None, policies=None, required_extensions=None, token_bound_cidrs=None, token_explicit_max_ttl=None, token_max_ttl=None, token_no_default_policy=None, token_num_uses=None, token_period=None, token_policies=None, token_ttl=None, token_type=None, ttl=None, __props__=None);

func NewCertAuthBackendRole(ctx *Context, name string, args CertAuthBackendRoleArgs, opts ...ResourceOption) (*CertAuthBackendRole, error)

public CertAuthBackendRole(string name, CertAuthBackendRoleArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args CertAuthBackendRoleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args CertAuthBackendRoleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args CertAuthBackendRoleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

CertAuthBackendRole Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The CertAuthBackendRole resource accepts the following input properties:

Certificate string

CA certificate used to validate client certificates

AllowedCommonNames List<string>

Allowed the common names for authenticated client certificates

AllowedDnsSans List<string>

Allowed alternative dns names for authenticated client certificates

AllowedEmailSans List<string>

Allowed emails for authenticated client certificates

AllowedNames List<string>

Allowed subject names for authenticated client certificates

AllowedOrganizationUnits List<string>

Allowed organization units for authenticated client certificates

AllowedUriSans List<string>

Allowed URIs for authenticated client certificates

Backend string

Path to the mounted Cert auth backend

BoundCidrs List<string>

Restriction usage of the certificates to client IPs falling within the range of the specified CIDRs

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

DisplayName string

The name to display on tokens issued under this role.

MaxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

Name string

Name of the role

Period string

If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies List<string>

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

RequiredExtensions List<string>

TLS extensions required on client certificates

TokenBoundCidrs List<string>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies List<string>

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

Ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

Certificate string

CA certificate used to validate client certificates

AllowedCommonNames []string

Allowed the common names for authenticated client certificates

AllowedDnsSans []string

Allowed alternative dns names for authenticated client certificates

AllowedEmailSans []string

Allowed emails for authenticated client certificates

AllowedNames []string

Allowed subject names for authenticated client certificates

AllowedOrganizationUnits []string

Allowed organization units for authenticated client certificates

AllowedUriSans []string

Allowed URIs for authenticated client certificates

Backend string

Path to the mounted Cert auth backend

BoundCidrs []string

Restriction usage of the certificates to client IPs falling within the range of the specified CIDRs

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

DisplayName string

The name to display on tokens issued under this role.

MaxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

Name string

Name of the role

Period string

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies []string

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

RequiredExtensions []string

TLS extensions required on client certificates

TokenBoundCidrs []string

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies []string

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

Ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

certificate string

CA certificate used to validate client certificates

allowedCommonNames string[]

Allowed the common names for authenticated client certificates

allowedDnsSans string[]

Allowed alternative dns names for authenticated client certificates

allowedEmailSans string[]

Allowed emails for authenticated client certificates

allowedNames string[]

Allowed subject names for authenticated client certificates

allowedOrganizationUnits string[]

Allowed organization units for authenticated client certificates

allowedUriSans string[]

Allowed URIs for authenticated client certificates

backend string

Path to the mounted Cert auth backend

boundCidrs string[]

Restriction usage of the certificates to client IPs falling within the range of the specified CIDRs

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

displayName string

The name to display on tokens issued under this role.

maxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

name string

Name of the role

period string

Deprecated: use token_period instead if you are running Vault >= 1.2

policies string[]

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

requiredExtensions string[]

TLS extensions required on client certificates

tokenBoundCidrs string[]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl number

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl number

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses number

The period, if any, in number of seconds to set on the token.

tokenPeriod number

tokenPolicies string[]

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

tokenTtl number

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType string

ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

certificate str

CA certificate used to validate client certificates

allowed_common_names List[str]

Allowed the common names for authenticated client certificates

allowed_dns_sans List[str]

Allowed alternative dns names for authenticated client certificates

allowed_email_sans List[str]

Allowed emails for authenticated client certificates

allowed_names List[str]

Allowed subject names for authenticated client certificates

allowed_organization_units List[str]

Allowed organization units for authenticated client certificates

allowed_uri_sans List[str]

Allowed URIs for authenticated client certificates

backend str

Path to the mounted Cert auth backend

bound_cidrs List[str]

Restriction usage of the certificates to client IPs falling within the range of the specified CIDRs

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

display_name str

The name to display on tokens issued under this role.

max_ttl str

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

name str

Name of the role

period str

Deprecated: use token_period instead if you are running Vault >= 1.2

policies List[str]

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

required_extensions List[str]

TLS extensions required on client certificates

token_bound_cidrs List[str]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

token_explicit_max_ttl float

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

token_max_ttl float

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

token_no_default_policy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

token_num_uses float

The period, if any, in number of seconds to set on the token.

token_period float

token_policies List[str]

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

token_ttl float

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

token_type str

ttl str

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

Outputs

All input properties are implicitly available as output properties. Additionally, the CertAuthBackendRole resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

Look up an Existing CertAuthBackendRole Resource

Get an existing CertAuthBackendRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: CertAuthBackendRoleState, opts?: CustomResourceOptions): CertAuthBackendRole

static get(resource_name, id, opts=None, allowed_common_names=None, allowed_dns_sans=None, allowed_email_sans=None, allowed_names=None, allowed_organization_units=None, allowed_uri_sans=None, backend=None, bound_cidrs=None, certificate=None, display_name=None, max_ttl=None, name=None, period=None, policies=None, required_extensions=None, token_bound_cidrs=None, token_explicit_max_ttl=None, token_max_ttl=None, token_no_default_policy=None, token_num_uses=None, token_period=None, token_policies=None, token_ttl=None, token_type=None, ttl=None, __props__=None);

func GetCertAuthBackendRole(ctx *Context, name string, id IDInput, state *CertAuthBackendRoleState, opts ...ResourceOption) (*CertAuthBackendRole, error)

public static CertAuthBackendRole Get(string name, Input<string> id, CertAuthBackendRoleState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AllowedCommonNames List<string>

Allowed the common names for authenticated client certificates

AllowedDnsSans List<string>

Allowed alternative dns names for authenticated client certificates

AllowedEmailSans List<string>

Allowed emails for authenticated client certificates

AllowedNames List<string>

Allowed subject names for authenticated client certificates

AllowedOrganizationUnits List<string>

Allowed organization units for authenticated client certificates

AllowedUriSans List<string>

Allowed URIs for authenticated client certificates

Backend string

Path to the mounted Cert auth backend

BoundCidrs List<string>

Restriction usage of the certificates to client IPs falling within the range of the specified CIDRs

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

Certificate string

CA certificate used to validate client certificates

DisplayName string

The name to display on tokens issued under this role.

MaxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

Name string

Name of the role

Period string

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies List<string>

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

RequiredExtensions List<string>

TLS extensions required on client certificates

TokenBoundCidrs List<string>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies List<string>

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

Ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

AllowedCommonNames []string

Allowed the common names for authenticated client certificates

AllowedDnsSans []string

Allowed alternative dns names for authenticated client certificates

AllowedEmailSans []string

Allowed emails for authenticated client certificates

AllowedNames []string

Allowed subject names for authenticated client certificates

AllowedOrganizationUnits []string

Allowed organization units for authenticated client certificates

AllowedUriSans []string

Allowed URIs for authenticated client certificates

Backend string

Path to the mounted Cert auth backend

BoundCidrs []string

Restriction usage of the certificates to client IPs falling within the range of the specified CIDRs

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

Certificate string

CA certificate used to validate client certificates

DisplayName string

The name to display on tokens issued under this role.

MaxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

Name string

Name of the role

Period string

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies []string

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

RequiredExtensions []string

TLS extensions required on client certificates

TokenBoundCidrs []string

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies []string

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

Ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

allowedCommonNames string[]

Allowed the common names for authenticated client certificates

allowedDnsSans string[]

Allowed alternative dns names for authenticated client certificates

allowedEmailSans string[]

Allowed emails for authenticated client certificates

allowedNames string[]

Allowed subject names for authenticated client certificates

allowedOrganizationUnits string[]

Allowed organization units for authenticated client certificates

allowedUriSans string[]

Allowed URIs for authenticated client certificates

backend string

Path to the mounted Cert auth backend

boundCidrs string[]

Restriction usage of the certificates to client IPs falling within the range of the specified CIDRs

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

certificate string

CA certificate used to validate client certificates

displayName string

The name to display on tokens issued under this role.

maxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

name string

Name of the role

period string

Deprecated: use token_period instead if you are running Vault >= 1.2

policies string[]

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

requiredExtensions string[]

TLS extensions required on client certificates

tokenBoundCidrs string[]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl number

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl number

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses number

The period, if any, in number of seconds to set on the token.

tokenPeriod number

tokenPolicies string[]

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

tokenTtl number

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType string

ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

allowed_common_names List[str]

Allowed the common names for authenticated client certificates

allowed_dns_sans List[str]

Allowed alternative dns names for authenticated client certificates

allowed_email_sans List[str]

Allowed emails for authenticated client certificates

allowed_names List[str]

Allowed subject names for authenticated client certificates

allowed_organization_units List[str]

Allowed organization units for authenticated client certificates

allowed_uri_sans List[str]

Allowed URIs for authenticated client certificates

backend str

Path to the mounted Cert auth backend

bound_cidrs List[str]

Restriction usage of the certificates to client IPs falling within the range of the specified CIDRs

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

certificate str

CA certificate used to validate client certificates

display_name str

The name to display on tokens issued under this role.

max_ttl str

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

name str

Name of the role

period str

Deprecated: use token_period instead if you are running Vault >= 1.2

policies List[str]

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

required_extensions List[str]

TLS extensions required on client certificates

token_bound_cidrs List[str]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

token_explicit_max_ttl float

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

token_max_ttl float