AuthBackendRole

Provides a resource to create a role in an GCP auth backend within Vault.

Create a AuthBackendRole Resource

new AuthBackendRole(name: string, args: AuthBackendRoleArgs, opts?: CustomResourceOptions);

def AuthBackendRole(resource_name, opts=None, add_group_aliases=None, allow_gce_inference=None, backend=None, bound_instance_groups=None, bound_labels=None, bound_projects=None, bound_regions=None, bound_service_accounts=None, bound_zones=None, max_jwt_exp=None, max_ttl=None, period=None, policies=None, role=None, token_bound_cidrs=None, token_explicit_max_ttl=None, token_max_ttl=None, token_no_default_policy=None, token_num_uses=None, token_period=None, token_policies=None, token_ttl=None, token_type=None, ttl=None, type=None, __props__=None);

func NewAuthBackendRole(ctx *Context, name string, args AuthBackendRoleArgs, opts ...ResourceOption) (*AuthBackendRole, error)

public AuthBackendRole(string name, AuthBackendRoleArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args AuthBackendRoleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args AuthBackendRoleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args AuthBackendRoleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

AuthBackendRole Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The AuthBackendRole resource accepts the following input properties:

Role string

Name of the GCP role

Type string

Type of GCP authentication role (either gce or iam)

AddGroupAliases bool

AllowGceInference bool

A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.

Backend string

Path to the mounted GCP auth backend

BoundInstanceGroups List<string>

The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either bound_zones or bound_regions must be set too.

BoundLabels List<string>

A comma-separated list of GCP labels formatted as "key:value" strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL’d, we recommend that this be used in conjunction with other restrictions.

BoundProjects List<string>

GCP Projects that the role exists within

BoundRegions List<string>

The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.

BoundServiceAccounts List<string>

GCP Service Accounts allowed to issue tokens under this role. (Note: Required if role is iam)

BoundZones List<string>

The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.

MaxJwtExp string

The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter exp. The GCE metadata tokens currently do not allow the exp claim to be customized.

MaxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

Period string

If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies List<string>

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

TokenBoundCidrs List<string>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies List<string>

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

Ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

Role string

Name of the GCP role

Type string

Type of GCP authentication role (either gce or iam)

AddGroupAliases bool

AllowGceInference bool

A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.

Backend string

Path to the mounted GCP auth backend

BoundInstanceGroups []string

The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either bound_zones or bound_regions must be set too.

BoundLabels []string

BoundProjects []string

GCP Projects that the role exists within

BoundRegions []string

BoundServiceAccounts []string

GCP Service Accounts allowed to issue tokens under this role. (Note: Required if role is iam)

BoundZones []string

The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.

MaxJwtExp string

MaxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

Period string

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies []string

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

TokenBoundCidrs []string

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies []string

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

Ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

role string

Name of the GCP role

type string

Type of GCP authentication role (either gce or iam)

addGroupAliases boolean

allowGceInference boolean

A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.

backend string

Path to the mounted GCP auth backend

boundInstanceGroups string[]

The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either bound_zones or bound_regions must be set too.

boundLabels string[]

boundProjects string[]

GCP Projects that the role exists within

boundRegions string[]

boundServiceAccounts string[]

GCP Service Accounts allowed to issue tokens under this role. (Note: Required if role is iam)

boundZones string[]

The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.

maxJwtExp string

maxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

period string

Deprecated: use token_period instead if you are running Vault >= 1.2

policies string[]

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

tokenBoundCidrs string[]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl number

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl number

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses number

The period, if any, in number of seconds to set on the token.

tokenPeriod number

tokenPolicies string[]

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

tokenTtl number

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType string

ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

role str

Name of the GCP role

type str

Type of GCP authentication role (either gce or iam)

add_group_aliases bool

allow_gce_inference bool

A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.

backend str

Path to the mounted GCP auth backend

bound_instance_groups List[str]

The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either bound_zones or bound_regions must be set too.

bound_labels List[str]

bound_projects List[str]

GCP Projects that the role exists within

bound_regions List[str]

bound_service_accounts List[str]

GCP Service Accounts allowed to issue tokens under this role. (Note: Required if role is iam)

bound_zones List[str]

The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.

max_jwt_exp str

max_ttl str

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

period str

Deprecated: use token_period instead if you are running Vault >= 1.2

policies List[str]

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

token_bound_cidrs List[str]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

token_explicit_max_ttl float

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

token_max_ttl float

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

token_no_default_policy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

token_num_uses float

The period, if any, in number of seconds to set on the token.

token_period float

token_policies List[str]

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

token_ttl float

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

token_type str

ttl str

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

Outputs

All input properties are implicitly available as output properties. Additionally, the AuthBackendRole resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

Look up an Existing AuthBackendRole Resource

Get an existing AuthBackendRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: AuthBackendRoleState, opts?: CustomResourceOptions): AuthBackendRole

static get(resource_name, id, opts=None, add_group_aliases=None, allow_gce_inference=None, backend=None, bound_instance_groups=None, bound_labels=None, bound_projects=None, bound_regions=None, bound_service_accounts=None, bound_zones=None, max_jwt_exp=None, max_ttl=None, period=None, policies=None, role=None, token_bound_cidrs=None, token_explicit_max_ttl=None, token_max_ttl=None, token_no_default_policy=None, token_num_uses=None, token_period=None, token_policies=None, token_ttl=None, token_type=None, ttl=None, type=None, __props__=None);

func GetAuthBackendRole(ctx *Context, name string, id IDInput, state *AuthBackendRoleState, opts ...ResourceOption) (*AuthBackendRole, error)

public static AuthBackendRole Get(string name, Input<string> id, AuthBackendRoleState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AddGroupAliases bool

AllowGceInference bool

A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.

Backend string

Path to the mounted GCP auth backend

BoundInstanceGroups List<string>

The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either bound_zones or bound_regions must be set too.

BoundLabels List<string>

BoundProjects List<string>

GCP Projects that the role exists within

BoundRegions List<string>

BoundServiceAccounts List<string>

GCP Service Accounts allowed to issue tokens under this role. (Note: Required if role is iam)

BoundZones List<string>

The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.

MaxJwtExp string

MaxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

Period string

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies List<string>

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

Role string

Name of the GCP role

TokenBoundCidrs List<string>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies List<string>

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

Ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

Type string

Type of GCP authentication role (either gce or iam)

AddGroupAliases bool

AllowGceInference bool

A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.

Backend string

Path to the mounted GCP auth backend

BoundInstanceGroups []string

The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either bound_zones or bound_regions must be set too.

BoundLabels []string

BoundProjects []string

GCP Projects that the role exists within

BoundRegions []string

BoundServiceAccounts []string

GCP Service Accounts allowed to issue tokens under this role. (Note: Required if role is iam)

BoundZones []string

The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.

MaxJwtExp string

MaxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

Period string

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies []string

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

Role string

Name of the GCP role

TokenBoundCidrs []string

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies []string

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

Ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

Type string

Type of GCP authentication role (either gce or iam)

addGroupAliases boolean

allowGceInference boolean

A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.

backend string

Path to the mounted GCP auth backend

boundInstanceGroups string[]

The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either bound_zones or bound_regions must be set too.

boundLabels string[]

boundProjects string[]

GCP Projects that the role exists within

boundRegions string[]

boundServiceAccounts string[]

GCP Service Accounts allowed to issue tokens under this role. (Note: Required if role is iam)

boundZones string[]

The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.

maxJwtExp string

maxTtl string

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

period string

Deprecated: use token_period instead if you are running Vault >= 1.2

policies string[]

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

role string

Name of the GCP role

tokenBoundCidrs string[]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl number

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl number

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses number

The period, if any, in number of seconds to set on the token.

tokenPeriod number

tokenPolicies string[]

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

tokenTtl number

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType string

ttl string

The TTL period of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_ttl instead if you are running Vault >= 1.2

type string

Type of GCP authentication role (either gce or iam)

add_group_aliases bool

allow_gce_inference bool

A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.

backend str

Path to the mounted GCP auth backend

bound_instance_groups List[str]

The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either bound_zones or bound_regions must be set too.

bound_labels List[str]

bound_projects List[str]

GCP Projects that the role exists within

bound_regions List[str]

bound_service_accounts List[str]

GCP Service Accounts allowed to issue tokens under this role. (Note: Required if role is iam)

bound_zones List[str]

The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.

max_jwt_exp str

max_ttl str

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

period str

Deprecated: use token_period instead if you are running Vault >= 1.2

policies List[str]

An array of strings specifying the policies to be set on tokens issued using this role.

Deprecated: use token_policies instead if you are running Vault >= 1.2

role str

Name of the GCP role

token_bound_cidrs List[str]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

token_explicit_max_ttl float

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

token_max_ttl float