pulumi-azure-kotlin/com.pulumi.azure.keyvault.kotlin/CertificateArgs

CertificateArgs

data class CertificateArgs(val certificate: Output<CertificateCertificateArgs>? = null, val certificatePolicy: Output<CertificateCertificatePolicyArgs>? = null, val keyVaultId: Output<String>? = null, val name: Output<String>? = null, val tags: Output<Map<String, String>>? = null) : ConvertibleToJava<CertificateArgs>

Manages a Key Vault Certificate. <<<<<<< HEAD

Note: The Azure Provider includes a Feature Toggle which will purge a Key Vault Certificate resource on destroy, rather than the default soft-delete. See purge_soft_deleted_certificates_on_destroy for more information. =======

8d78c87098 (Update-documentation)

Example Usage

Importing A PFX)

Note: this example assumed the PFX file is located in the same directory at certificate-to-import.pfx.

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.inputs.KeyVaultAccessPolicyArgs;
import com.pulumi.azure.keyvault.Certificate;
import com.pulumi.azure.keyvault.CertificateArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificateArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("West Europe")
            .build());
        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("premium")
            .accessPolicies(KeyVaultAccessPolicyArgs.builder()
                .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
                .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
                .certificatePermissions(
                    "Create",
                    "Delete",
                    "DeleteIssuers",
                    "Get",
                    "GetIssuers",
                    "Import",
                    "List",
                    "ListIssuers",
                    "ManageContacts",
                    "ManageIssuers",
                    "SetIssuers",
                    "Update")
                .keyPermissions(
                    "Backup",
                    "Create",
                    "Decrypt",
                    "Delete",
                    "Encrypt",
                    "Get",
                    "Import",
                    "List",
                    "Purge",
                    "Recover",
                    "Restore",
                    "Sign",
                    "UnwrapKey",
                    "Update",
                    "Verify",
                    "WrapKey")
                .secretPermissions(
                    "Backup",
                    "Delete",
                    "Get",
                    "List",
                    "Purge",
                    "Recover",
                    "Restore",
                    "Set")
                .build())
            .build());
        var exampleCertificate = new Certificate("exampleCertificate", CertificateArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .certificate(CertificateCertificateArgs.builder()
                .contents(Base64.getEncoder().encodeToString(Files.readAllBytes(Paths.get("certificate-to-import.pfx"))))
                .password("")
                .build())
            .build());
    }
}
Content copied to clipboard

Generating a new certificate

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.inputs.KeyVaultAccessPolicyArgs;
import com.pulumi.azure.keyvault.Certificate;
import com.pulumi.azure.keyvault.CertificateArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyIssuerParametersArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyKeyPropertiesArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicySecretPropertiesArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyX509CertificatePropertiesArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("West Europe")
            .build());
        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("standard")
            .softDeleteRetentionDays(7)
            .accessPolicies(KeyVaultAccessPolicyArgs.builder()
                .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
                .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
                .certificatePermissions(
                    "Create",
                    "Delete",
                    "DeleteIssuers",
                    "Get",
                    "GetIssuers",
                    "Import",
                    "List",
                    "ListIssuers",
                    "ManageContacts",
                    "ManageIssuers",
                    "Purge",
                    "SetIssuers",
                    "Update")
                .keyPermissions(
                    "Backup",
                    "Create",
                    "Decrypt",
                    "Delete",
                    "Encrypt",
                    "Get",
                    "Import",
                    "List",
                    "Purge",
                    "Recover",
                    "Restore",
                    "Sign",
                    "UnwrapKey",
                    "Update",
                    "Verify",
                    "WrapKey")
                .secretPermissions(
                    "Backup",
                    "Delete",
                    "Get",
                    "List",
                    "Purge",
                    "Recover",
                    "Restore",
                    "Set")
                .build())
            .build());
        var exampleCertificate = new Certificate("exampleCertificate", CertificateArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .certificatePolicy(CertificateCertificatePolicyArgs.builder()
                .issuerParameters(CertificateCertificatePolicyIssuerParametersArgs.builder()
                    .name("Self")
                    .build())
                .keyProperties(CertificateCertificatePolicyKeyPropertiesArgs.builder()
                    .exportable(true)
                    .keySize(2048)
                    .keyType("RSA")
                    .reuseKey(true)
                    .build())
                .lifetimeActions(CertificateCertificatePolicyLifetimeActionArgs.builder()
                    .action(CertificateCertificatePolicyLifetimeActionActionArgs.builder()
                        .actionType("AutoRenew")
                        .build())
                    .trigger(CertificateCertificatePolicyLifetimeActionTriggerArgs.builder()
                        .daysBeforeExpiry(30)
                        .build())
                    .build())
                .secretProperties(CertificateCertificatePolicySecretPropertiesArgs.builder()
                    .contentType("application/x-pkcs12")
                    .build())
                .x509CertificateProperties(CertificateCertificatePolicyX509CertificatePropertiesArgs.builder()
                    .extendedKeyUsages("1.3.6.1.5.5.7.3.1")
                    .keyUsages(
                        "cRLSign",
                        "dataEncipherment",
                        "digitalSignature",
                        "keyAgreement",
                        "keyCertSign",
                        "keyEncipherment")
                    .subjectAlternativeNames(CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs.builder()
                        .dnsNames(
                            "internal.contoso.com",
                            "domain.hello.world")
                        .build())
                    .subject("CN=hello-world")
                    .validityInMonths(12)
                    .build())
                .build())
            .build());
    }
}
Content copied to clipboard

Import

Key Vault Certificates can be imported using the resource id, e.g.

$ pulumi import azure:keyvault/certificate:Certificate example "https://example-keyvault.vault.azure.net/certificates/example/fdf067c93bbb4b22bff4d8b7a9a56217"
Content copied to clipboard

Constructors

Link copied to clipboard
fun CertificateArgs(certificate: Output<CertificateCertificateArgs>? = null, certificatePolicy: Output<CertificateCertificatePolicyArgs>? = null, keyVaultId: Output<String>? = null, name: Output<String>? = null, tags: Output<Map<String, String>>? = null)

Functions

Link copied to clipboard
open override fun toJava(): CertificateArgs

Properties

Link copied to clipboard
val certificate: Output<CertificateCertificateArgs>? = null

A certificate block as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate.

Link copied to clipboard
val certificatePolicy: Output<CertificateCertificatePolicyArgs>? = null

A certificate_policy block as defined below. Changing this will create a new version of the Key Vault Certificate.

Link copied to clipboard
val keyVaultId: Output<String>? = null

The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.

Link copied to clipboard
val name: Output<String>? = null

Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.

Link copied to clipboard
val tags: Output<Map<String, String>>? = null

A mapping of tags to assign to the resource.