Group

Creates an Identity Group for Vault. The Identity secrets engine is the identity management solution for Vault.

A group can contain multiple entities as its members. A group can also have subgroups. Policies set on the group is granted to all members of the group. During request time, when the token’s entity ID is being evaluated for the policies that it has access to; along with the policies on the entity itself, policies that are inherited due to group memberships are also granted.

Example Usage

Internal Group

using Pulumi;
using Vault = Pulumi.Vault;

class MyStack : Stack
{
    public MyStack()
    {
        var @internal = new Vault.Identity.Group("internal", new Vault.Identity.GroupArgs
        {
            Metadata = 
            {
                { "version", "2" },
            },
            Policies = 
            {
                "dev",
                "test",
            },
            Type = "internal",
        });
    }

}

Coming soon!

import pulumi
import pulumi_vault as vault

internal = vault.identity.Group("internal",
    metadata={
        "version": "2",
    },
    policies=[
        "dev",
        "test",
    ],
    type="internal")

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const internal = new vault.identity.Group("internal", {
    metadata: {
        version: "2",
    },
    policies: [
        "dev",
        "test",
    ],
    type: "internal",
});

External Group

using Pulumi;
using Vault = Pulumi.Vault;

class MyStack : Stack
{
    public MyStack()
    {
        var @group = new Vault.Identity.Group("group", new Vault.Identity.GroupArgs
        {
            Metadata = 
            {
                { "version", "1" },
            },
            Policies = 
            {
                "test",
            },
            Type = "external",
        });
    }

}

Coming soon!

import pulumi
import pulumi_vault as vault

group = vault.identity.Group("group",
    metadata={
        "version": "1",
    },
    policies=["test"],
    type="external")

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const group = new vault.identity.Group("group", {
    metadata: {
        version: "1",
    },
    policies: ["test"],
    type: "external",
});

Create a Group Resource

new Group(name: string, args?: GroupArgs, opts?: CustomResourceOptions);

def Group(resource_name, opts=None, external_policies=None, member_entity_ids=None, member_group_ids=None, metadata=None, name=None, policies=None, type=None, __props__=None);

func NewGroup(ctx *Context, name string, args *GroupArgs, opts ...ResourceOption) (*Group, error)

public Group(string name, GroupArgs? args = null, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args GroupArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args GroupArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args GroupArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

Group Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The Group resource accepts the following input properties:

ExternalPolicies bool: false by default. If set to true, this resource will ignore any policies return from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
MemberEntityIds List<string>: A list of Entity IDs to be assigned as group members. Not allowed on external groups.
MemberGroupIds List<string>: A list of Group IDs to be assigned as group members. Not allowed on external groups.
Metadata Dictionary<string, string>: A Map of additional metadata to associate with the group.
Name string: Name of the identity group to create.
Policies List<string>: A list of policies to apply to the group.
Type string: Type of the group, internal or external. Defaults to internal.

ExternalPolicies bool: false by default. If set to true, this resource will ignore any policies return from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
MemberEntityIds []string: A list of Entity IDs to be assigned as group members. Not allowed on external groups.
MemberGroupIds []string: A list of Group IDs to be assigned as group members. Not allowed on external groups.
Metadata map[string]string: A Map of additional metadata to associate with the group.
Name string: Name of the identity group to create.
Policies []string: A list of policies to apply to the group.
Type string: Type of the group, internal or external. Defaults to internal.

externalPolicies boolean: false by default. If set to true, this resource will ignore any policies return from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
memberEntityIds string[]: A list of Entity IDs to be assigned as group members. Not allowed on external groups.
memberGroupIds string[]: A list of Group IDs to be assigned as group members. Not allowed on external groups.
metadata {[key: string]: string}: A Map of additional metadata to associate with the group.
name string: Name of the identity group to create.
policies string[]: A list of policies to apply to the group.
type string: Type of the group, internal or external. Defaults to internal.

external_policies bool: false by default. If set to true, this resource will ignore any policies return from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
member_entity_ids List[str]: A list of Entity IDs to be assigned as group members. Not allowed on external groups.
member_group_ids List[str]: A list of Group IDs to be assigned as group members. Not allowed on external groups.
metadata Dict[str, str]: A Map of additional metadata to associate with the group.
name str: Name of the identity group to create.
policies List[str]: A list of policies to apply to the group.
type str: Type of the group, internal or external. Defaults to internal.

Outputs

All input properties are implicitly available as output properties. Additionally, the Group resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

Look up an Existing Group Resource

Get an existing Group resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: GroupState, opts?: CustomResourceOptions): Group

static get(resource_name, id, opts=None, external_policies=None, member_entity_ids=None, member_group_ids=None, metadata=None, name=None, policies=None, type=None, __props__=None);

func GetGroup(ctx *Context, name string, id IDInput, state *GroupState, opts ...ResourceOption) (*Group, error)

public static Group Get(string name, Input<string> id, GroupState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

ExternalPolicies bool: false by default. If set to true, this resource will ignore any policies return from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
MemberEntityIds List<string>: A list of Entity IDs to be assigned as group members. Not allowed on external groups.
MemberGroupIds List<string>: A list of Group IDs to be assigned as group members. Not allowed on external groups.
Metadata Dictionary<string, string>: A Map of additional metadata to associate with the group.
Name string: Name of the identity group to create.
Policies List<string>: A list of policies to apply to the group.
Type string: Type of the group, internal or external. Defaults to internal.

ExternalPolicies bool: false by default. If set to true, this resource will ignore any policies return from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
MemberEntityIds []string: A list of Entity IDs to be assigned as group members. Not allowed on external groups.
MemberGroupIds []string: A list of Group IDs to be assigned as group members. Not allowed on external groups.
Metadata map[string]string: A Map of additional metadata to associate with the group.
Name string: Name of the identity group to create.
Policies []string: A list of policies to apply to the group.
Type string: Type of the group, internal or external. Defaults to internal.

externalPolicies boolean: false by default. If set to true, this resource will ignore any policies return from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
memberEntityIds string[]: A list of Entity IDs to be assigned as group members. Not allowed on external groups.
memberGroupIds string[]: A list of Group IDs to be assigned as group members. Not allowed on external groups.
metadata {[key: string]: string}: A Map of additional metadata to associate with the group.
name string: Name of the identity group to create.
policies string[]: A list of policies to apply to the group.
type string: Type of the group, internal or external. Defaults to internal.

external_policies bool: false by default. If set to true, this resource will ignore any policies return from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.
member_entity_ids List[str]: A list of Entity IDs to be assigned as group members. Not allowed on external groups.
member_group_ids List[str]: A list of Group IDs to be assigned as group members. Not allowed on external groups.
metadata Dict[str, str]: A Map of additional metadata to associate with the group.
name str: Name of the identity group to create.
policies List[str]: A list of policies to apply to the group.
type str: Type of the group, internal or external. Defaults to internal.

Package Details

Repository: https://github.com/pulumi/pulumi-vault
License: Apache-2.0
Notes: This Pulumi package is based on the vault Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud