AuthBackendRole

Manages Token auth backend role in a Vault server. See the Vault documentation for more information.

Example Usage

using Pulumi;
using Vault = Pulumi.Vault;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Vault.TokenAuth.AuthBackendRole("example", new Vault.TokenAuth.AuthBackendRoleArgs
        {
            AllowedPolicies = 
            {
                "dev",
                "test",
            },
            DisallowedPolicies = 
            {
                "default",
            },
            ExplicitMaxTtl = "115200",
            Orphan = true,
            PathSuffix = "path-suffix",
            Period = "86400",
            Renewable = true,
            RoleName = "my-role",
        });
    }

}

Coming soon!

import pulumi
import pulumi_vault as vault

example = vault.tokenauth.AuthBackendRole("example",
    allowed_policies=[
        "dev",
        "test",
    ],
    disallowed_policies=["default"],
    explicit_max_ttl="115200",
    orphan=True,
    path_suffix="path-suffix",
    period="86400",
    renewable=True,
    role_name="my-role")

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const example = new vault.tokenauth.AuthBackendRole("example", {
    allowedPolicies: [
        "dev",
        "test",
    ],
    disallowedPolicies: ["default"],
    explicitMaxTtl: "115200",
    orphan: true,
    pathSuffix: "path-suffix",
    period: "86400",
    renewable: true,
    roleName: "my-role",
});

Create a AuthBackendRole Resource

new AuthBackendRole(name: string, args: AuthBackendRoleArgs, opts?: CustomResourceOptions);

def AuthBackendRole(resource_name, opts=None, allowed_policies=None, bound_cidrs=None, disallowed_policies=None, explicit_max_ttl=None, orphan=None, path_suffix=None, period=None, renewable=None, role_name=None, token_bound_cidrs=None, token_explicit_max_ttl=None, token_max_ttl=None, token_no_default_policy=None, token_num_uses=None, token_period=None, token_policies=None, token_ttl=None, token_type=None, __props__=None);

func NewAuthBackendRole(ctx *Context, name string, args AuthBackendRoleArgs, opts ...ResourceOption) (*AuthBackendRole, error)

public AuthBackendRole(string name, AuthBackendRoleArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args AuthBackendRoleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args AuthBackendRoleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args AuthBackendRoleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

AuthBackendRole Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The AuthBackendRole resource accepts the following input properties:

RoleName string

The name of the role.

AllowedPolicies List<string>

List of allowed policies for given role.

BoundCidrs List<string>

If set, a list of CIDRs valid as the source address for login requests. This value is also encoded into any resulting token.

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

DisallowedPolicies List<string>

List of disallowed policies for given role.

ExplicitMaxTtl string

If set, the token will have an explicit max TTL set upon it.

Deprecated: use token_explicit_max_ttl instead if you are running Vault >= 1.2

Orphan bool

If true, tokens created against this policy will be orphan tokens.

PathSuffix string

Tokens created against this role will have the given suffix as part of their path in addition to the role name.

Period string

If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.

Deprecated: use token_period instead if you are running Vault >= 1.2

Renewable bool

Wether to disable the ability of the token to be renewed past its initial TTL.

TokenBoundCidrs List<string>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies List<string>

Generated Token’s Policies

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

RoleName string

The name of the role.

AllowedPolicies []string

List of allowed policies for given role.

BoundCidrs []string

If set, a list of CIDRs valid as the source address for login requests. This value is also encoded into any resulting token.

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

DisallowedPolicies []string

List of disallowed policies for given role.

ExplicitMaxTtl string

If set, the token will have an explicit max TTL set upon it.

Deprecated: use token_explicit_max_ttl instead if you are running Vault >= 1.2

Orphan bool

If true, tokens created against this policy will be orphan tokens.

PathSuffix string

Tokens created against this role will have the given suffix as part of their path in addition to the role name.

Period string

Deprecated: use token_period instead if you are running Vault >= 1.2

Renewable bool

Wether to disable the ability of the token to be renewed past its initial TTL.

TokenBoundCidrs []string

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies []string

Generated Token’s Policies

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

roleName string

The name of the role.

allowedPolicies string[]

List of allowed policies for given role.

boundCidrs string[]

If set, a list of CIDRs valid as the source address for login requests. This value is also encoded into any resulting token.

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

disallowedPolicies string[]

List of disallowed policies for given role.

explicitMaxTtl string

If set, the token will have an explicit max TTL set upon it.

Deprecated: use token_explicit_max_ttl instead if you are running Vault >= 1.2

orphan boolean

If true, tokens created against this policy will be orphan tokens.

pathSuffix string

Tokens created against this role will have the given suffix as part of their path in addition to the role name.

period string

Deprecated: use token_period instead if you are running Vault >= 1.2

renewable boolean

Wether to disable the ability of the token to be renewed past its initial TTL.

tokenBoundCidrs string[]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl number

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl number

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses number

The period, if any, in number of seconds to set on the token.

tokenPeriod number

tokenPolicies string[]

Generated Token’s Policies

tokenTtl number

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType string

role_name str

The name of the role.

allowed_policies List[str]

List of allowed policies for given role.

bound_cidrs List[str]

If set, a list of CIDRs valid as the source address for login requests. This value is also encoded into any resulting token.

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

disallowed_policies List[str]

List of disallowed policies for given role.

explicit_max_ttl str

If set, the token will have an explicit max TTL set upon it.

Deprecated: use token_explicit_max_ttl instead if you are running Vault >= 1.2

orphan bool

If true, tokens created against this policy will be orphan tokens.

path_suffix str

Tokens created against this role will have the given suffix as part of their path in addition to the role name.

period str

Deprecated: use token_period instead if you are running Vault >= 1.2

renewable bool

Wether to disable the ability of the token to be renewed past its initial TTL.

token_bound_cidrs List[str]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

token_explicit_max_ttl float

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

token_max_ttl float

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

token_no_default_policy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

token_num_uses float

The period, if any, in number of seconds to set on the token.

token_period float

token_policies List[str]

Generated Token’s Policies

token_ttl float

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

token_type str

Outputs

All input properties are implicitly available as output properties. Additionally, the AuthBackendRole resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

Look up an Existing AuthBackendRole Resource

Get an existing AuthBackendRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: AuthBackendRoleState, opts?: CustomResourceOptions): AuthBackendRole

static get(resource_name, id, opts=None, allowed_policies=None, bound_cidrs=None, disallowed_policies=None, explicit_max_ttl=None, orphan=None, path_suffix=None, period=None, renewable=None, role_name=None, token_bound_cidrs=None, token_explicit_max_ttl=None, token_max_ttl=None, token_no_default_policy=None, token_num_uses=None, token_period=None, token_policies=None, token_ttl=None, token_type=None, __props__=None);

func GetAuthBackendRole(ctx *Context, name string, id IDInput, state *AuthBackendRoleState, opts ...ResourceOption) (*AuthBackendRole, error)

public static AuthBackendRole Get(string name, Input<string> id, AuthBackendRoleState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AllowedPolicies List<string>

List of allowed policies for given role.

BoundCidrs List<string>

If set, a list of CIDRs valid as the source address for login requests. This value is also encoded into any resulting token.

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

DisallowedPolicies List<string>

List of disallowed policies for given role.

ExplicitMaxTtl string

If set, the token will have an explicit max TTL set upon it.

Deprecated: use token_explicit_max_ttl instead if you are running Vault >= 1.2

Orphan bool

If true, tokens created against this policy will be orphan tokens.

PathSuffix string

Tokens created against this role will have the given suffix as part of their path in addition to the role name.

Period string

Deprecated: use token_period instead if you are running Vault >= 1.2

Renewable bool

Wether to disable the ability of the token to be renewed past its initial TTL.

RoleName string

The name of the role.

TokenBoundCidrs List<string>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies List<string>

Generated Token’s Policies

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

AllowedPolicies []string

List of allowed policies for given role.

BoundCidrs []string

If set, a list of CIDRs valid as the source address for login requests. This value is also encoded into any resulting token.

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

DisallowedPolicies []string

List of disallowed policies for given role.

ExplicitMaxTtl string

If set, the token will have an explicit max TTL set upon it.

Deprecated: use token_explicit_max_ttl instead if you are running Vault >= 1.2

Orphan bool

If true, tokens created against this policy will be orphan tokens.

PathSuffix string

Tokens created against this role will have the given suffix as part of their path in addition to the role name.

Period string

Deprecated: use token_period instead if you are running Vault >= 1.2

Renewable bool

Wether to disable the ability of the token to be renewed past its initial TTL.

RoleName string

The name of the role.

TokenBoundCidrs []string

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

TokenPolicies []string

Generated Token’s Policies

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

allowedPolicies string[]

List of allowed policies for given role.

boundCidrs string[]

If set, a list of CIDRs valid as the source address for login requests. This value is also encoded into any resulting token.

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

disallowedPolicies string[]

List of disallowed policies for given role.

explicitMaxTtl string

If set, the token will have an explicit max TTL set upon it.

Deprecated: use token_explicit_max_ttl instead if you are running Vault >= 1.2

orphan boolean

If true, tokens created against this policy will be orphan tokens.

pathSuffix string

Tokens created against this role will have the given suffix as part of their path in addition to the role name.

period string

Deprecated: use token_period instead if you are running Vault >= 1.2

renewable boolean

Wether to disable the ability of the token to be renewed past its initial TTL.

roleName string

The name of the role.

tokenBoundCidrs string[]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl number

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl number

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses number

The period, if any, in number of seconds to set on the token.

tokenPeriod number

tokenPolicies string[]

Generated Token’s Policies

tokenTtl number

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType string

allowed_policies List[str]

List of allowed policies for given role.

bound_cidrs List[str]

If set, a list of CIDRs valid as the source address for login requests. This value is also encoded into any resulting token.

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

disallowed_policies List[str]

List of disallowed policies for given role.

explicit_max_ttl str

If set, the token will have an explicit max TTL set upon it.

Deprecated: use token_explicit_max_ttl instead if you are running Vault >= 1.2

orphan bool

If true, tokens created against this policy will be orphan tokens.

path_suffix str

Tokens created against this role will have the given suffix as part of their path in addition to the role name.

period str

Deprecated: use token_period instead if you are running Vault >= 1.2

renewable bool

Wether to disable the ability of the token to be renewed past its initial TTL.

role_name str

The name of the role.

token_bound_cidrs List[str]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

token_explicit_max_ttl float

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

token_max_ttl float