SecretBackendRole

Provides a resource to manage roles in an SSH secret backend SSH secret backend within Vault.

Example Usage

using Pulumi;
using Vault = Pulumi.Vault;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Vault.Mount("example", new Vault.MountArgs
        {
            Type = "ssh",
        });
        var foo = new Vault.Ssh.SecretBackendRole("foo", new Vault.Ssh.SecretBackendRoleArgs
        {
            AllowUserCertificates = true,
            Backend = example.Path,
            KeyType = "ca",
        });
        var bar = new Vault.Ssh.SecretBackendRole("bar", new Vault.Ssh.SecretBackendRoleArgs
        {
            AllowedUsers = "default,baz",
            Backend = example.Path,
            CidrList = "0.0.0.0/0",
            DefaultUser = "default",
            KeyType = "otp",
        });
    }

}

Coming soon!

import pulumi
import pulumi_vault as vault

example = vault.Mount("example", type="ssh")
foo = vault.ssh.SecretBackendRole("foo",
    allow_user_certificates=True,
    backend=example.path,
    key_type="ca")
bar = vault.ssh.SecretBackendRole("bar",
    allowed_users="default,baz",
    backend=example.path,
    cidr_list="0.0.0.0/0",
    default_user="default",
    key_type="otp")

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const example = new vault.Mount("example", {
    type: "ssh",
});
const foo = new vault.ssh.SecretBackendRole("foo", {
    allowUserCertificates: true,
    backend: example.path,
    keyType: "ca",
});
const bar = new vault.ssh.SecretBackendRole("bar", {
    allowedUsers: "default,baz",
    backend: example.path,
    cidrList: "0.0.0.0/0",
    defaultUser: "default",
    keyType: "otp",
});

Create a SecretBackendRole Resource

new SecretBackendRole(name: string, args: SecretBackendRoleArgs, opts?: CustomResourceOptions);

def SecretBackendRole(resource_name, opts=None, allow_bare_domains=None, allow_host_certificates=None, allow_subdomains=None, allow_user_certificates=None, allow_user_key_ids=None, allowed_critical_options=None, allowed_domains=None, allowed_extensions=None, allowed_user_key_lengths=None, allowed_users=None, backend=None, cidr_list=None, default_critical_options=None, default_extensions=None, default_user=None, key_id_format=None, key_type=None, max_ttl=None, name=None, ttl=None, __props__=None);

func NewSecretBackendRole(ctx *Context, name string, args SecretBackendRoleArgs, opts ...ResourceOption) (*SecretBackendRole, error)

public SecretBackendRole(string name, SecretBackendRoleArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args SecretBackendRoleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args SecretBackendRoleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args SecretBackendRoleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

SecretBackendRole Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The SecretBackendRole resource accepts the following input properties:

Backend string: The path where the SSH secret backend is mounted.
KeyType string: Specifies the type of credentials generated by this role. This can be either otp, dynamic or ca.
AllowBareDomains bool: Specifies if host certificates that are requested are allowed to use the base domains listed in allowed_domains.
AllowHostCertificates bool: Specifies if certificates are allowed to be signed for use as a ‘host’.
AllowSubdomains bool: Specifies if host certificates that are requested are allowed to be subdomains of those listed in allowed_domains.
AllowUserCertificates bool: Specifies if certificates are allowed to be signed for use as a ‘user’.
AllowUserKeyIds bool: Specifies if users can override the key ID for a signed certificate with the key_id field.
AllowedCriticalOptions string: Specifies a comma-separated list of critical options that certificates can have when signed.
AllowedDomains string: The list of domains for which a client can request a host certificate.
AllowedExtensions string: Specifies a comma-separated list of extensions that certificates can have when signed.
AllowedUserKeyLengths Dictionary<string, object>: Specifies a map of ssh key types and their expected sizes which are allowed to be signed by the CA type.
AllowedUsers string: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed.
CidrList string: The comma-separated string of CIDR blocks for which this role is applicable.
DefaultCriticalOptions Dictionary<string, object>: Specifies a map of critical options that certificates have when signed.
DefaultExtensions Dictionary<string, object>: Specifies a map of extensions that certificates have when signed.
DefaultUser string: Specifies the default username for which a credential will be generated.
KeyIdFormat string: Specifies a custom format for the key id of a signed certificate.
MaxTtl string: Specifies the maximum Time To Live value.
Name string: Specifies the name of the role to create.
Ttl string: Specifies the Time To Live value.

Backend string: The path where the SSH secret backend is mounted.
KeyType string: Specifies the type of credentials generated by this role. This can be either otp, dynamic or ca.
AllowBareDomains bool: Specifies if host certificates that are requested are allowed to use the base domains listed in allowed_domains.
AllowHostCertificates bool: Specifies if certificates are allowed to be signed for use as a ‘host’.
AllowSubdomains bool: Specifies if host certificates that are requested are allowed to be subdomains of those listed in allowed_domains.
AllowUserCertificates bool: Specifies if certificates are allowed to be signed for use as a ‘user’.
AllowUserKeyIds bool: Specifies if users can override the key ID for a signed certificate with the key_id field.
AllowedCriticalOptions string: Specifies a comma-separated list of critical options that certificates can have when signed.
AllowedDomains string: The list of domains for which a client can request a host certificate.
AllowedExtensions string: Specifies a comma-separated list of extensions that certificates can have when signed.
AllowedUserKeyLengths map[string]interface{}: Specifies a map of ssh key types and their expected sizes which are allowed to be signed by the CA type.
AllowedUsers string: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed.
CidrList string: The comma-separated string of CIDR blocks for which this role is applicable.
DefaultCriticalOptions map[string]interface{}: Specifies a map of critical options that certificates have when signed.
DefaultExtensions map[string]interface{}: Specifies a map of extensions that certificates have when signed.
DefaultUser string: Specifies the default username for which a credential will be generated.
KeyIdFormat string: Specifies a custom format for the key id of a signed certificate.
MaxTtl string: Specifies the maximum Time To Live value.
Name string: Specifies the name of the role to create.
Ttl string: Specifies the Time To Live value.

backend string: The path where the SSH secret backend is mounted.
keyType string: Specifies the type of credentials generated by this role. This can be either otp, dynamic or ca.
allowBareDomains boolean: Specifies if host certificates that are requested are allowed to use the base domains listed in allowed_domains.
allowHostCertificates boolean: Specifies if certificates are allowed to be signed for use as a ‘host’.
allowSubdomains boolean: Specifies if host certificates that are requested are allowed to be subdomains of those listed in allowed_domains.
allowUserCertificates boolean: Specifies if certificates are allowed to be signed for use as a ‘user’.
allowUserKeyIds boolean: Specifies if users can override the key ID for a signed certificate with the key_id field.
allowedCriticalOptions string: Specifies a comma-separated list of critical options that certificates can have when signed.
allowedDomains string: The list of domains for which a client can request a host certificate.
allowedExtensions string: Specifies a comma-separated list of extensions that certificates can have when signed.
allowedUserKeyLengths {[key: string]: any}: Specifies a map of ssh key types and their expected sizes which are allowed to be signed by the CA type.
allowedUsers string: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed.
cidrList string: The comma-separated string of CIDR blocks for which this role is applicable.
defaultCriticalOptions {[key: string]: any}: Specifies a map of critical options that certificates have when signed.
defaultExtensions {[key: string]: any}: Specifies a map of extensions that certificates have when signed.
defaultUser string: Specifies the default username for which a credential will be generated.
keyIdFormat string: Specifies a custom format for the key id of a signed certificate.
maxTtl string: Specifies the maximum Time To Live value.
name string: Specifies the name of the role to create.
ttl string: Specifies the Time To Live value.

backend str: The path where the SSH secret backend is mounted.
key_type str: Specifies the type of credentials generated by this role. This can be either otp, dynamic or ca.
allow_bare_domains bool: Specifies if host certificates that are requested are allowed to use the base domains listed in allowed_domains.
allow_host_certificates bool: Specifies if certificates are allowed to be signed for use as a ‘host’.
allow_subdomains bool: Specifies if host certificates that are requested are allowed to be subdomains of those listed in allowed_domains.
allow_user_certificates bool: Specifies if certificates are allowed to be signed for use as a ‘user’.
allow_user_key_ids bool: Specifies if users can override the key ID for a signed certificate with the key_id field.
allowed_critical_options str: Specifies a comma-separated list of critical options that certificates can have when signed.
allowed_domains str: The list of domains for which a client can request a host certificate.
allowed_extensions str: Specifies a comma-separated list of extensions that certificates can have when signed.
allowed_user_key_lengths Dict[str, Any]: Specifies a map of ssh key types and their expected sizes which are allowed to be signed by the CA type.
allowed_users str: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed.
cidr_list str: The comma-separated string of CIDR blocks for which this role is applicable.
default_critical_options Dict[str, Any]: Specifies a map of critical options that certificates have when signed.
default_extensions Dict[str, Any]: Specifies a map of extensions that certificates have when signed.
default_user str: Specifies the default username for which a credential will be generated.
key_id_format str: Specifies a custom format for the key id of a signed certificate.
max_ttl str: Specifies the maximum Time To Live value.
name str: Specifies the name of the role to create.
ttl str: Specifies the Time To Live value.

Outputs

All input properties are implicitly available as output properties. Additionally, the SecretBackendRole resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

Look up an Existing SecretBackendRole Resource

Get an existing SecretBackendRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: SecretBackendRoleState, opts?: CustomResourceOptions): SecretBackendRole

static get(resource_name, id, opts=None, allow_bare_domains=None, allow_host_certificates=None, allow_subdomains=None, allow_user_certificates=None, allow_user_key_ids=None, allowed_critical_options=None, allowed_domains=None, allowed_extensions=None, allowed_user_key_lengths=None, allowed_users=None, backend=None, cidr_list=None, default_critical_options=None, default_extensions=None, default_user=None, key_id_format=None, key_type=None, max_ttl=None, name=None, ttl=None, __props__=None);

func GetSecretBackendRole(ctx *Context, name string, id IDInput, state *SecretBackendRoleState, opts ...ResourceOption) (*SecretBackendRole, error)

public static SecretBackendRole Get(string name, Input<string> id, SecretBackendRoleState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AllowBareDomains bool: Specifies if host certificates that are requested are allowed to use the base domains listed in allowed_domains.
AllowHostCertificates bool: Specifies if certificates are allowed to be signed for use as a ‘host’.
AllowSubdomains bool: Specifies if host certificates that are requested are allowed to be subdomains of those listed in allowed_domains.
AllowUserCertificates bool: Specifies if certificates are allowed to be signed for use as a ‘user’.
AllowUserKeyIds bool: Specifies if users can override the key ID for a signed certificate with the key_id field.
AllowedCriticalOptions string: Specifies a comma-separated list of critical options that certificates can have when signed.
AllowedDomains string: The list of domains for which a client can request a host certificate.
AllowedExtensions string: Specifies a comma-separated list of extensions that certificates can have when signed.
AllowedUserKeyLengths Dictionary<string, object>: Specifies a map of ssh key types and their expected sizes which are allowed to be signed by the CA type.
AllowedUsers string: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed.
Backend string: The path where the SSH secret backend is mounted.
CidrList string: The comma-separated string of CIDR blocks for which this role is applicable.
DefaultCriticalOptions Dictionary<string, object>: Specifies a map of critical options that certificates have when signed.
DefaultExtensions Dictionary<string, object>: Specifies a map of extensions that certificates have when signed.
DefaultUser string: Specifies the default username for which a credential will be generated.
KeyIdFormat string: Specifies a custom format for the key id of a signed certificate.
KeyType string: Specifies the type of credentials generated by this role. This can be either otp, dynamic or ca.
MaxTtl string: Specifies the maximum Time To Live value.
Name string: Specifies the name of the role to create.
Ttl string: Specifies the Time To Live value.

AllowBareDomains bool: Specifies if host certificates that are requested are allowed to use the base domains listed in allowed_domains.
AllowHostCertificates bool: Specifies if certificates are allowed to be signed for use as a ‘host’.
AllowSubdomains bool: Specifies if host certificates that are requested are allowed to be subdomains of those listed in allowed_domains.
AllowUserCertificates bool: Specifies if certificates are allowed to be signed for use as a ‘user’.
AllowUserKeyIds bool: Specifies if users can override the key ID for a signed certificate with the key_id field.
AllowedCriticalOptions string: Specifies a comma-separated list of critical options that certificates can have when signed.
AllowedDomains string: The list of domains for which a client can request a host certificate.
AllowedExtensions string: Specifies a comma-separated list of extensions that certificates can have when signed.
AllowedUserKeyLengths map[string]interface{}: Specifies a map of ssh key types and their expected sizes which are allowed to be signed by the CA type.
AllowedUsers string: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed.
Backend string: The path where the SSH secret backend is mounted.
CidrList string: The comma-separated string of CIDR blocks for which this role is applicable.
DefaultCriticalOptions map[string]interface{}: Specifies a map of critical options that certificates have when signed.
DefaultExtensions map[string]interface{}: Specifies a map of extensions that certificates have when signed.
DefaultUser string: Specifies the default username for which a credential will be generated.
KeyIdFormat string: Specifies a custom format for the key id of a signed certificate.
KeyType string: Specifies the type of credentials generated by this role. This can be either otp, dynamic or ca.
MaxTtl string: Specifies the maximum Time To Live value.
Name string: Specifies the name of the role to create.
Ttl string: Specifies the Time To Live value.

allowBareDomains boolean: Specifies if host certificates that are requested are allowed to use the base domains listed in allowed_domains.
allowHostCertificates boolean: Specifies if certificates are allowed to be signed for use as a ‘host’.
allowSubdomains boolean: Specifies if host certificates that are requested are allowed to be subdomains of those listed in allowed_domains.
allowUserCertificates boolean: Specifies if certificates are allowed to be signed for use as a ‘user’.
allowUserKeyIds boolean: Specifies if users can override the key ID for a signed certificate with the key_id field.
allowedCriticalOptions string: Specifies a comma-separated list of critical options that certificates can have when signed.
allowedDomains string: The list of domains for which a client can request a host certificate.
allowedExtensions string: Specifies a comma-separated list of extensions that certificates can have when signed.
allowedUserKeyLengths {[key: string]: any}: Specifies a map of ssh key types and their expected sizes which are allowed to be signed by the CA type.
allowedUsers string: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed.
backend string: The path where the SSH secret backend is mounted.
cidrList string: The comma-separated string of CIDR blocks for which this role is applicable.
defaultCriticalOptions {[key: string]: any}: Specifies a map of critical options that certificates have when signed.
defaultExtensions {[key: string]: any}: Specifies a map of extensions that certificates have when signed.
defaultUser string: Specifies the default username for which a credential will be generated.
keyIdFormat string: Specifies a custom format for the key id of a signed certificate.
keyType string: Specifies the type of credentials generated by this role. This can be either otp, dynamic or ca.
maxTtl string: Specifies the maximum Time To Live value.
name string: Specifies the name of the role to create.
ttl string: Specifies the Time To Live value.

allow_bare_domains bool: Specifies if host certificates that are requested are allowed to use the base domains listed in allowed_domains.
allow_host_certificates bool: Specifies if certificates are allowed to be signed for use as a ‘host’.
allow_subdomains bool: Specifies if host certificates that are requested are allowed to be subdomains of those listed in allowed_domains.
allow_user_certificates bool: Specifies if certificates are allowed to be signed for use as a ‘user’.
allow_user_key_ids bool: Specifies if users can override the key ID for a signed certificate with the key_id field.
allowed_critical_options str: Specifies a comma-separated list of critical options that certificates can have when signed.
allowed_domains str: The list of domains for which a client can request a host certificate.
allowed_extensions str: Specifies a comma-separated list of extensions that certificates can have when signed.
allowed_user_key_lengths Dict[str, Any]: Specifies a map of ssh key types and their expected sizes which are allowed to be signed by the CA type.
allowed_users str: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed.
backend str: The path where the SSH secret backend is mounted.
cidr_list str: The comma-separated string of CIDR blocks for which this role is applicable.
default_critical_options Dict[str, Any]: Specifies a map of critical options that certificates have when signed.
default_extensions Dict[str, Any]: Specifies a map of extensions that certificates have when signed.
default_user str: Specifies the default username for which a credential will be generated.
key_id_format str: Specifies a custom format for the key id of a signed certificate.
key_type str: Specifies the type of credentials generated by this role. This can be either otp, dynamic or ca.
max_ttl str: Specifies the maximum Time To Live value.
name str: Specifies the name of the role to create.
ttl str: Specifies the Time To Live value.

Package Details

Repository: https://github.com/pulumi/pulumi-vault
License: Apache-2.0
Notes: This Pulumi package is based on the vault Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud