pulumi-azure-kotlin/com.pulumi.azure.keyvault.kotlin/KeyArgs

KeyArgs

data class KeyArgs(val curve: Output<String>? = null, val expirationDate: Output<String>? = null, val keyOpts: Output<List<String>>? = null, val keySize: Output<Int>? = null, val keyType: Output<String>? = null, val keyVaultId: Output<String>? = null, val name: Output<String>? = null, val notBeforeDate: Output<String>? = null, val rotationPolicy: Output<KeyRotationPolicyArgs>? = null, val tags: Output<Map<String, String>>? = null) : ConvertibleToJava<KeyArgs>

Manages a Key Vault Key.

Example Usage

Note: To use this resource, your client should have RBAC roles with permissions like Key Vault Crypto Officer or Key Vault Administrator or an assigned Key Vault Access Policy with permissions Create,Delete,Get,Purge,Recover,Update and GetRotationPolicy for keys without Rotation Policy. Include SetRotationPolicy for keys with Rotation Policy. Note: The Azure Provider includes a Feature Toggle which will purge a Key Vault Key resource on destroy, rather than the default soft-delete. See purge_soft_deleted_keys_on_destroy for more information.

Additional Examples

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.inputs.KeyVaultAccessPolicyArgs;
import com.pulumi.azure.keyvault.Key;
import com.pulumi.azure.keyvault.KeyArgs;
import com.pulumi.azure.keyvault.inputs.KeyRotationPolicyArgs;
import com.pulumi.azure.keyvault.inputs.KeyRotationPolicyAutomaticArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("West Europe")
            .build());
        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("premium")
            .softDeleteRetentionDays(7)
            .accessPolicies(KeyVaultAccessPolicyArgs.builder()
                .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
                .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
                .keyPermissions(
                    "Create",
                    "Delete",
                    "Get",
                    "Purge",
                    "Recover",
                    "Update",
                    "GetRotationPolicy",
                    "SetRotationPolicy")
                .secretPermissions("Set")
                .build())
            .build());
        var generated = new Key("generated", KeyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .keyType("RSA")
            .keySize(2048)
            .keyOpts(
                "decrypt",
                "encrypt",
                "sign",
                "unwrapKey",
                "verify",
                "wrapKey")
            .rotationPolicy(KeyRotationPolicyArgs.builder()
                .automatic(KeyRotationPolicyAutomaticArgs.builder()
                    .timeBeforeExpiry("P30D")
                    .build())
                .expireAfter("P90D")
                .notifyBeforeExpiry("P29D")
                .build())
            .build());
    }
}

Import

Key Vault Key which is Enabled can be imported using the resource id, e.g.

$ pulumi import azure:keyvault/key:Key example "https://example-keyvault.vault.azure.net/keys/example/fdf067c93bbb4b22bff4d8b7a9a56217"

Constructors

KeyArgs

fun KeyArgs(curve: Output<String>? = null, expirationDate: Output<String>? = null, keyOpts: Output<List<String>>? = null, keySize: Output<Int>? = null, keyType: Output<String>? = null, keyVaultId: Output<String>? = null, name: Output<String>? = null, notBeforeDate: Output<String>? = null, rotationPolicy: Output<KeyRotationPolicyArgs>? = null, tags: Output<Map<String, String>>? = null)

Functions

toJava

open override fun toJava(): KeyArgs

Properties

curve

val curve: Output<String>? = null

Specifies the curve to use when creating an EC key. Possible values are P-256, P-256K, P-384, and P-521. This field will be required in a future release if key_type is EC or EC-HSM. The API will default to P-256 if nothing is specified. Changing this forces a new resource to be created.

expirationDate

val expirationDate: Output<String>? = null

Expiration UTC datetime (Y-m-d'T'H:M:S'Z').

keyOpts

val keyOpts: Output<List<String>>? = null

A list of JSON web key operations. Possible values include: decrypt, encrypt, sign, unwrapKey, verify and wrapKey. Please note these values are case sensitive.

keySize

val keySize: Output<Int>? = null

Specifies the Size of the RSA key to create in bytes. For example, 1024 or 2048. Note: This field is required if key_type is RSA or RSA-HSM. Changing this forces a new resource to be created.

keyType

val keyType: Output<String>? = null

Specifies the Key Type to use for this Key Vault Key. Possible values are EC (Elliptic Curve), EC-HSM, RSA and RSA-HSM. Changing this forces a new resource to be created.

keyVaultId

val keyVaultId: Output<String>? = null

The ID of the Key Vault where the Key should be created. Changing this forces a new resource to be created.

name

val name: Output<String>? = null

Specifies the name of the Key Vault Key. Changing this forces a new resource to be created.

notBeforeDate

val notBeforeDate: Output<String>? = null

Key not usable before the provided UTC datetime (Y-m-d'T'H:M:S'Z').

rotationPolicy

val rotationPolicy: Output<KeyRotationPolicyArgs>? = null

A rotation_policy block as defined below.