Managed
Manages a Key Vault Managed Hardware Security Module Key.
Note: The Azure Provider includes a Feature Toggle which will purge a Key Vault Managed Hardware Security Module Key resource on destroy, rather than the default soft-delete. See
purge_soft_deleted_hardware_security_modules_on_destroyfor more information.
resources:
example:
type: azure:keyvault:ManagedHardwareSecurityModule
properties:
name: example
resourceGroupName: ${exampleAzurermResourceGroup.name}
location: ${exampleAzurermResourceGroup.location}
skuName: Standard_B1
tenantId: ${current.tenantId}
adminObjectIds:
- ${current.objectId}
purgeProtectionEnabled: false
activeConfig:
- securityDomainCertificate:
- ${cert[0].id}
- ${cert[1].id}
- ${cert[2].id}
securityDomainQuorum: 2
# this gives your service principal the HSM Crypto User role which lets you create and destroy hsm keys
hsm-crypto-user:
type: azure:keyvault:ManagedHardwareSecurityModuleRoleAssignment
properties:
managedHsmId: ${test.id}
name: 1e243909-064c-6ac3-84e9-1c8bf8d6ad22
scope: /keys
roleDefinitionId: /Microsoft.KeyVault/providers/Microsoft.Authorization/roleDefinitions/21dbd100-6940-42c2-9190-5d6cb909625b
principalId: ${current.objectId}
# this gives your service principal the HSM Crypto Officer role which lets you purge hsm keys
hsm-crypto-officer:
type: azure:keyvault:ManagedHardwareSecurityModuleRoleAssignment
properties:
managedHsmId: ${test.id}
name: 1e243909-064c-6ac3-84e9-1c8bf8d6ad23
scope: /keys
roleDefinitionId: /Microsoft.KeyVault/providers/Microsoft.Authorization/roleDefinitions/515eb02d-2335-4d2d-92f2-b1cbdf9c3778
principalId: ${current.objectId}
exampleManagedHardwareSecurityModuleKey:
type: azure:keyvault:ManagedHardwareSecurityModuleKey
name: example
properties:
name: example
managedHsmId: ${test.id}
keyType: EC-HSM
curve: P-521
keyOpts:
- sign
options:
dependsOn:
- ${testAzurermKeyVaultManagedHardwareSecurityModuleRoleAssignment}
- ${test1}
variables:
current:
fn::invoke:
function: azure:core:getClientConfig
arguments: {}Import
Key Vault Managed Hardware Security Module Key can be imported using the resource id, e.g.
$ pulumi import azure:keyvault/managedHardwareSecurityModuleKey:ManagedHardwareSecurityModuleKey example https://exampleHSM.managedhsm.azure.net/keys/exampleKeyConstructors
Properties
Expiration UTC datetime (Y-m-d'T'H:M:S'Z'). When this parameter gets changed on reruns, if newer date is ahead of current date, an update is performed. If the newer date is before the current date, resource will be force created.
Specifies the Key Type to use for this Key Vault Managed Hardware Security Module Key. Possible values are EC-HSM, oct-HSM and RSA-HSM. More details see HSM-protected keys. Changing this forces a new resource to be created.
Specifies the ID of the Key Vault Managed Hardware Security Module that they key will be owned by. Changing this forces a new resource to be created.
Key not usable before the provided UTC datetime (Y-m-d'T'H:M:S'Z').