pulumi-azure-kotlin/com.pulumi.azure.keyvault.kotlin/Key

Key

class Key : KotlinCustomResource

Manages a Key Vault Key.

Example Usage

Note: To use this resource, your client should have RBAC roles with permissions like Key Vault Crypto Officer or Key Vault Administrator or an assigned Key Vault Access Policy with permissions Create,Delete,Get,Purge,Recover,Update and GetRotationPolicy for keys without Rotation Policy. Include SetRotationPolicy for keys with Rotation Policy. Note: The Azure Provider includes a Feature Toggle which will purge a Key Vault Key resource on destroy, rather than the default soft-delete. See purge_soft_deleted_keys_on_destroy for more information.

Additional Examples

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.inputs.KeyVaultAccessPolicyArgs;
import com.pulumi.azure.keyvault.Key;
import com.pulumi.azure.keyvault.KeyArgs;
import com.pulumi.azure.keyvault.inputs.KeyRotationPolicyArgs;
import com.pulumi.azure.keyvault.inputs.KeyRotationPolicyAutomaticArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();
        var example = new ResourceGroup("example", ResourceGroupArgs.builder()
            .name("example-resources")
            .location("West Europe")
            .build());
        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .name("examplekeyvault")
            .location(example.location())
            .resourceGroupName(example.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("premium")
            .softDeleteRetentionDays(7)
            .accessPolicies(KeyVaultAccessPolicyArgs.builder()
                .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
                .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
                .keyPermissions(
                    "Create",
                    "Delete",
                    "Get",
                    "Purge",
                    "Recover",
                    "Update",
                    "GetRotationPolicy",
                    "SetRotationPolicy")
                .secretPermissions("Set")
                .build())
            .build());
        var generated = new Key("generated", KeyArgs.builder()
            .name("generated-certificate")
            .keyVaultId(exampleKeyVault.id())
            .keyType("RSA")
            .keySize(2048)
            .keyOpts(
                "decrypt",
                "encrypt",
                "sign",
                "unwrapKey",
                "verify",
                "wrapKey")
            .rotationPolicy(KeyRotationPolicyArgs.builder()
                .automatic(KeyRotationPolicyAutomaticArgs.builder()
                    .timeBeforeExpiry("P30D")
                    .build())
                .expireAfter("P90D")
                .notifyBeforeExpiry("P29D")
                .build())
            .build());
    }
}

Import

Key Vault Key which is Enabled can be imported using the resource id, e.g.

$ pulumi import azure:keyvault/key:Key example "https://example-keyvault.vault.azure.net/keys/example/fdf067c93bbb4b22bff4d8b7a9a56217"

Properties

curve

val curve: Output<String>

Specifies the curve to use when creating an EC key. Possible values are P-256, P-256K, P-384, and P-521. This field will be required in a future release if key_type is EC or EC-HSM. The API will default to P-256 if nothing is specified. Changing this forces a new resource to be created.

val e: Output<String>

The RSA public exponent of this Key Vault Key.

expirationDate

val expirationDate: Output<String>?

Expiration UTC datetime (Y-m-d'T'H:M:S'Z'). When this parameter gets changed on reruns, if newer date is ahead of current date, an update is performed. If the newer date is before the current date, resource will be force created.

val id: Output<String>

keyOpts

val keyOpts: Output<List<String>>

A list of JSON web key operations. Possible values include: decrypt, encrypt, sign, unwrapKey, verify and wrapKey. Please note these values are case sensitive.

keySize

val keySize: Output<Int>?

Specifies the Size of the RSA key to create in bytes. For example, 1024 or 2048. Note: This field is required if key_type is RSA or RSA-HSM. Changing this forces a new resource to be created.

keyType

val keyType: Output<String>

Specifies the Key Type to use for this Key Vault Key. Possible values are EC (Elliptic Curve), EC-HSM, RSA and RSA-HSM. Changing this forces a new resource to be created.

keyVaultId

val keyVaultId: Output<String>

The ID of the Key Vault where the Key should be created. Changing this forces a new resource to be created.

val n: Output<String>

The RSA modulus of this Key Vault Key.

name

val name: Output<String>

Specifies the name of the Key Vault Key. Changing this forces a new resource to be created.

notBeforeDate

val notBeforeDate: Output<String>?

Key not usable before the provided UTC datetime (Y-m-d'T'H:M:S'Z').

publicKeyOpenssh

val publicKeyOpenssh: Output<String>

The OpenSSH encoded public key of this Key Vault Key.

publicKeyPem

val publicKeyPem: Output<String>

The PEM encoded public key of this Key Vault Key.

pulumiChildResources

val pulumiChildResources: Set<KotlinResource>

pulumiResourceName

val pulumiResourceName: String

pulumiResourceType

val pulumiResourceType: String

resourceId

val resourceId: Output<String>

The (Versioned) ID for this Key Vault Key. This property points to a specific version of a Key Vault Key, as such using this won't auto-rotate values if used in other Azure Services.

resourceVersionlessId

val resourceVersionlessId: Output<String>

The Versionless ID of the Key Vault Key. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Key is updated.

rotationPolicy

val rotationPolicy: Output<KeyRotationPolicy>?

A rotation_policy block as defined below.