pulumi-azure-kotlin/com.pulumi.azure.keyvault.kotlin/Certificate

Certificate

class Certificate : KotlinCustomResource

Manages a Key Vault Certificate. <<<<<<< HEAD

Note: The Azure Provider includes a Feature Toggle which will purge a Key Vault Certificate resource on destroy, rather than the default soft-delete. See purge_soft_deleted_certificates_on_destroy for more information. =======

8d78c87098 (Update-documentation)

Example Usage

Importing A PFX)

Note: this example assumed the PFX file is located in the same directory at certificate-to-import.pfx.

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.inputs.KeyVaultAccessPolicyArgs;
import com.pulumi.azure.keyvault.Certificate;
import com.pulumi.azure.keyvault.CertificateArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificateArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("West Europe")
            .build());
        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("premium")
            .accessPolicies(KeyVaultAccessPolicyArgs.builder()
                .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
                .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
                .certificatePermissions(
                    "Create",
                    "Delete",
                    "DeleteIssuers",
                    "Get",
                    "GetIssuers",
                    "Import",
                    "List",
                    "ListIssuers",
                    "ManageContacts",
                    "ManageIssuers",
                    "SetIssuers",
                    "Update")
                .keyPermissions(
                    "Backup",
                    "Create",
                    "Decrypt",
                    "Delete",
                    "Encrypt",
                    "Get",
                    "Import",
                    "List",
                    "Purge",
                    "Recover",
                    "Restore",
                    "Sign",
                    "UnwrapKey",
                    "Update",
                    "Verify",
                    "WrapKey")
                .secretPermissions(
                    "Backup",
                    "Delete",
                    "Get",
                    "List",
                    "Purge",
                    "Recover",
                    "Restore",
                    "Set")
                .build())
            .build());
        var exampleCertificate = new Certificate("exampleCertificate", CertificateArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .certificate(CertificateCertificateArgs.builder()
                .contents(Base64.getEncoder().encodeToString(Files.readAllBytes(Paths.get("certificate-to-import.pfx"))))
                .password("")
                .build())
            .build());
    }
}
Content copied to clipboard

Generating a new certificate

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.inputs.KeyVaultAccessPolicyArgs;
import com.pulumi.azure.keyvault.Certificate;
import com.pulumi.azure.keyvault.CertificateArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyIssuerParametersArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyKeyPropertiesArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicySecretPropertiesArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyX509CertificatePropertiesArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("West Europe")
            .build());
        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("standard")
            .softDeleteRetentionDays(7)
            .accessPolicies(KeyVaultAccessPolicyArgs.builder()
                .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
                .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
                .certificatePermissions(
                    "Create",
                    "Delete",
                    "DeleteIssuers",
                    "Get",
                    "GetIssuers",
                    "Import",
                    "List",
                    "ListIssuers",
                    "ManageContacts",
                    "ManageIssuers",
                    "Purge",
                    "SetIssuers",
                    "Update")
                .keyPermissions(
                    "Backup",
                    "Create",
                    "Decrypt",
                    "Delete",
                    "Encrypt",
                    "Get",
                    "Import",
                    "List",
                    "Purge",
                    "Recover",
                    "Restore",
                    "Sign",
                    "UnwrapKey",
                    "Update",
                    "Verify",
                    "WrapKey")
                .secretPermissions(
                    "Backup",
                    "Delete",
                    "Get",
                    "List",
                    "Purge",
                    "Recover",
                    "Restore",
                    "Set")
                .build())
            .build());
        var exampleCertificate = new Certificate("exampleCertificate", CertificateArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .certificatePolicy(CertificateCertificatePolicyArgs.builder()
                .issuerParameters(CertificateCertificatePolicyIssuerParametersArgs.builder()
                    .name("Self")
                    .build())
                .keyProperties(CertificateCertificatePolicyKeyPropertiesArgs.builder()
                    .exportable(true)
                    .keySize(2048)
                    .keyType("RSA")
                    .reuseKey(true)
                    .build())
                .lifetimeActions(CertificateCertificatePolicyLifetimeActionArgs.builder()
                    .action(CertificateCertificatePolicyLifetimeActionActionArgs.builder()
                        .actionType("AutoRenew")
                        .build())
                    .trigger(CertificateCertificatePolicyLifetimeActionTriggerArgs.builder()
                        .daysBeforeExpiry(30)
                        .build())
                    .build())
                .secretProperties(CertificateCertificatePolicySecretPropertiesArgs.builder()
                    .contentType("application/x-pkcs12")
                    .build())
                .x509CertificateProperties(CertificateCertificatePolicyX509CertificatePropertiesArgs.builder()
                    .extendedKeyUsages("1.3.6.1.5.5.7.3.1")
                    .keyUsages(
                        "cRLSign",
                        "dataEncipherment",
                        "digitalSignature",
                        "keyAgreement",
                        "keyCertSign",
                        "keyEncipherment")
                    .subjectAlternativeNames(CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs.builder()
                        .dnsNames(
                            "internal.contoso.com",
                            "domain.hello.world")
                        .build())
                    .subject("CN=hello-world")
                    .validityInMonths(12)
                    .build())
                .build())
            .build());
    }
}
Content copied to clipboard

Import

Key Vault Certificates can be imported using the resource id, e.g.

$ pulumi import azure:keyvault/certificate:Certificate example "https://example-keyvault.vault.azure.net/certificates/example/fdf067c93bbb4b22bff4d8b7a9a56217"
Content copied to clipboard

Properties

Link copied to clipboard
val certificate: Output<CertificateCertificate>?

A certificate block as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate.

Link copied to clipboard
val certificateAttributes: Output<List<CertificateCertificateAttribute>>

A certificate_attribute block as defined below.

Link copied to clipboard
val certificateData: Output<String>

The raw Key Vault Certificate data represented as a hexadecimal string.

Link copied to clipboard
val certificateDataBase64: Output<String>

The Base64 encoded Key Vault Certificate data.

Link copied to clipboard
val certificatePolicy: Output<CertificateCertificatePolicy>

A certificate_policy block as defined below. Changing this will create a new version of the Key Vault Certificate.

Link copied to clipboard
val id: Output<String>
Link copied to clipboard
val keyVaultId: Output<String>

The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.

Link copied to clipboard
val name: Output<String>

Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.

Link copied to clipboard
val pulumiChildResources: Set<KotlinResource>
Link copied to clipboard
Link copied to clipboard
Link copied to clipboard
val resourceManagerId: Output<String>

The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.

Link copied to clipboard
val resourceManagerVersionlessId: Output<String>

The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.

Link copied to clipboard
val secretId: Output<String>

The ID of the associated Key Vault Secret.

Link copied to clipboard
val tags: Output<Map<String, String>>?

A mapping of tags to assign to the resource.

Link copied to clipboard
val thumbprint: Output<String>

The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.

Link copied to clipboard
val urn: Output<String>
Link copied to clipboard
val version: Output<String>

The current version of the Key Vault Certificate.

Link copied to clipboard
val versionlessId: Output<String>

The Base ID of the Key Vault Certificate.

Link copied to clipboard
val versionlessSecretId: Output<String>

The Base ID of the Key Vault Secret.