pulumi-vault-kotlin/com.pulumi.vault.azure.kotlin/AuthBackendConfigArgs

AuthBackendConfigArgs

data class AuthBackendConfigArgs(val backend: Output<String>? = null, val clientId: Output<String>? = null, val clientSecret: Output<String>? = null, val disableAutomatedRotation: Output<Boolean>? = null, val environment: Output<String>? = null, val identityTokenAudience: Output<String>? = null, val identityTokenTtl: Output<Int>? = null, val namespace: Output<String>? = null, val resource: Output<String>? = null, val rotationPeriod: Output<Int>? = null, val rotationSchedule: Output<String>? = null, val rotationWindow: Output<Int>? = null, val tenantId: Output<String>? = null) : ConvertibleToJava<AuthBackendConfigArgs>

Example Usage

You can setup the Azure auth engine with Workload Identity Federation (WIF) for a secret-less configuration:

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const example = new vault.AuthBackend("example", {
    type: "azure",
    identityTokenKey: "example-key",
});
const exampleAuthBackendConfig = new vault.azure.AuthBackendConfig("example", {
    backend: example.path,
    tenantId: "11111111-2222-3333-4444-555555555555",
    clientId: "11111111-2222-3333-4444-555555555555",
    identityTokenAudience: "<TOKEN_AUDIENCE>",
    identityTokenTtl: "<TOKEN_TTL>",
    rotationSchedule: "0 * * * SAT",
    rotationWindow: 3600,
});
Content copied to clipboard
import pulumi
import pulumi_vault as vault
example = vault.AuthBackend("example",
    type="azure",
    identity_token_key="example-key")
example_auth_backend_config = vault.azure.AuthBackendConfig("example",
    backend=example.path,
    tenant_id="11111111-2222-3333-4444-555555555555",
    client_id="11111111-2222-3333-4444-555555555555",
    identity_token_audience="<TOKEN_AUDIENCE>",
    identity_token_ttl="<TOKEN_TTL>",
    rotation_schedule="0 * * * SAT",
    rotation_window=3600)
Content copied to clipboard
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
    var example = new Vault.AuthBackend("example", new()
    {
        Type = "azure",
        IdentityTokenKey = "example-key",
    });
    var exampleAuthBackendConfig = new Vault.Azure.AuthBackendConfig("example", new()
    {
        Backend = example.Path,
        TenantId = "11111111-2222-3333-4444-555555555555",
        ClientId = "11111111-2222-3333-4444-555555555555",
        IdentityTokenAudience = "<TOKEN_AUDIENCE>",
        IdentityTokenTtl = "<TOKEN_TTL>",
        RotationSchedule = "0 * * * SAT",
        RotationWindow = 3600,
    });
});
Content copied to clipboard
package main
import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/azure"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := vault.NewAuthBackend(ctx, "example", &vault.AuthBackendArgs{
			Type:             pulumi.String("azure"),
			IdentityTokenKey: pulumi.String("example-key"),
		})
		if err != nil {
			return err
		}
		_, err = azure.NewAuthBackendConfig(ctx, "example", &azure.AuthBackendConfigArgs{
			Backend:               example.Path,
			TenantId:              pulumi.String("11111111-2222-3333-4444-555555555555"),
			ClientId:              pulumi.String("11111111-2222-3333-4444-555555555555"),
			IdentityTokenAudience: pulumi.String("<TOKEN_AUDIENCE>"),
			IdentityTokenTtl:      pulumi.Int("<TOKEN_TTL>"),
			RotationSchedule:      pulumi.String("0 * * * SAT"),
			RotationWindow:        pulumi.Int(3600),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.azure.AuthBackendConfig;
import com.pulumi.vault.azure.AuthBackendConfigArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var example = new AuthBackend("example", AuthBackendArgs.builder()
            .type("azure")
            .identityTokenKey("example-key")
            .build());
        var exampleAuthBackendConfig = new AuthBackendConfig("exampleAuthBackendConfig", AuthBackendConfigArgs.builder()
            .backend(example.path())
            .tenantId("11111111-2222-3333-4444-555555555555")
            .clientId("11111111-2222-3333-4444-555555555555")
            .identityTokenAudience("<TOKEN_AUDIENCE>")
            .identityTokenTtl("<TOKEN_TTL>")
            .rotationSchedule("0 * * * SAT")
            .rotationWindow(3600)
            .build());
    }
}
Content copied to clipboard
resources:
  example:
    type: vault:AuthBackend
    properties:
      type: azure
      identityTokenKey: example-key
  exampleAuthBackendConfig:
    type: vault:azure:AuthBackendConfig
    name: example
    properties:
      backend: ${example.path}
      tenantId: 11111111-2222-3333-4444-555555555555
      clientId: 11111111-2222-3333-4444-555555555555
      identityTokenAudience: <TOKEN_AUDIENCE>
      identityTokenTtl: <TOKEN_TTL>
      rotationSchedule: 0 * * * SAT
      rotationWindow: 3600
Content copied to clipboard
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const example = new vault.AuthBackend("example", {type: "azure"});
const exampleAuthBackendConfig = new vault.azure.AuthBackendConfig("example", {
    backend: example.path,
    tenantId: "11111111-2222-3333-4444-555555555555",
    clientId: "11111111-2222-3333-4444-555555555555",
    clientSecret: "01234567890123456789",
    resource: "https://vault.hashicorp.com",
    rotationSchedule: "0 * * * SAT",
    rotationWindow: 3600,
});
Content copied to clipboard
import pulumi
import pulumi_vault as vault
example = vault.AuthBackend("example", type="azure")
example_auth_backend_config = vault.azure.AuthBackendConfig("example",
    backend=example.path,
    tenant_id="11111111-2222-3333-4444-555555555555",
    client_id="11111111-2222-3333-4444-555555555555",
    client_secret="01234567890123456789",
    resource="https://vault.hashicorp.com",
    rotation_schedule="0 * * * SAT",
    rotation_window=3600)
Content copied to clipboard
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
    var example = new Vault.AuthBackend("example", new()
    {
        Type = "azure",
    });
    var exampleAuthBackendConfig = new Vault.Azure.AuthBackendConfig("example", new()
    {
        Backend = example.Path,
        TenantId = "11111111-2222-3333-4444-555555555555",
        ClientId = "11111111-2222-3333-4444-555555555555",
        ClientSecret = "01234567890123456789",
        Resource = "https://vault.hashicorp.com",
        RotationSchedule = "0 * * * SAT",
        RotationWindow = 3600,
    });
});
Content copied to clipboard
package main
import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/azure"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := vault.NewAuthBackend(ctx, "example", &vault.AuthBackendArgs{
			Type: pulumi.String("azure"),
		})
		if err != nil {
			return err
		}
		_, err = azure.NewAuthBackendConfig(ctx, "example", &azure.AuthBackendConfigArgs{
			Backend:          example.Path,
			TenantId:         pulumi.String("11111111-2222-3333-4444-555555555555"),
			ClientId:         pulumi.String("11111111-2222-3333-4444-555555555555"),
			ClientSecret:     pulumi.String("01234567890123456789"),
			Resource:         pulumi.String("https://vault.hashicorp.com"),
			RotationSchedule: pulumi.String("0 * * * SAT"),
			RotationWindow:   pulumi.Int(3600),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.azure.AuthBackendConfig;
import com.pulumi.vault.azure.AuthBackendConfigArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var example = new AuthBackend("example", AuthBackendArgs.builder()
            .type("azure")
            .build());
        var exampleAuthBackendConfig = new AuthBackendConfig("exampleAuthBackendConfig", AuthBackendConfigArgs.builder()
            .backend(example.path())
            .tenantId("11111111-2222-3333-4444-555555555555")
            .clientId("11111111-2222-3333-4444-555555555555")
            .clientSecret("01234567890123456789")
            .resource("https://vault.hashicorp.com")
            .rotationSchedule("0 * * * SAT")
            .rotationWindow(3600)
            .build());
    }
}
Content copied to clipboard
resources:
  example:
    type: vault:AuthBackend
    properties:
      type: azure
  exampleAuthBackendConfig:
    type: vault:azure:AuthBackendConfig
    name: example
    properties:
      backend: ${example.path}
      tenantId: 11111111-2222-3333-4444-555555555555
      clientId: 11111111-2222-3333-4444-555555555555
      clientSecret: '01234567890123456789'
      resource: https://vault.hashicorp.com
      rotationSchedule: 0 * * * SAT
      rotationWindow: 3600
Content copied to clipboard

Import

Azure auth backends can be imported using auth/, the backend path, and /config e.g.

$ pulumi import vault:azure/authBackendConfig:AuthBackendConfig example auth/azure/config
Content copied to clipboard

Constructors

Link copied to clipboard
constructor(backend: Output<String>? = null, clientId: Output<String>? = null, clientSecret: Output<String>? = null, disableAutomatedRotation: Output<Boolean>? = null, environment: Output<String>? = null, identityTokenAudience: Output<String>? = null, identityTokenTtl: Output<Int>? = null, namespace: Output<String>? = null, resource: Output<String>? = null, rotationPeriod: Output<Int>? = null, rotationSchedule: Output<String>? = null, rotationWindow: Output<Int>? = null, tenantId: Output<String>? = null)

Properties

Link copied to clipboard
val backend: Output<String>? = null

The path the Azure auth backend being configured was mounted at. Defaults to azure.

Link copied to clipboard
val clientId: Output<String>? = null

The client id for credentials to query the Azure APIs. Currently read permissions to query compute resources are required.

Link copied to clipboard
val clientSecret: Output<String>? = null

The client secret for credentials to query the Azure APIs.

Link copied to clipboard
val disableAutomatedRotation: Output<Boolean>? = null

Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+. Available only for Vault Enterprise

Link copied to clipboard
val environment: Output<String>? = null

The Azure cloud environment. Valid values: AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud. Defaults to AzurePublicCloud.

Link copied to clipboard
val identityTokenAudience: Output<String>? = null

The audience claim value for plugin identity tokens. Requires Vault 1.17+. Available only for Vault Enterprise

Link copied to clipboard
val identityTokenTtl: Output<Int>? = null

The TTL of generated identity tokens in seconds.

Link copied to clipboard
val namespace: Output<String>? = null

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

Link copied to clipboard
val resource: Output<String>? = null

The configured URL for the application registered in Azure Active Directory.

Link copied to clipboard
val rotationPeriod: Output<Int>? = null

The amount of time in seconds Vault should wait before rotating the root credential. A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+. Available only for Vault Enterprise

Link copied to clipboard
val rotationSchedule: Output<String>? = null

The schedule, in cron-style time format, defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. Available only for Vault Enterprise

Link copied to clipboard
val rotationWindow: Output<Int>? = null

The maximum amount of time in seconds allowed to complete a rotation when a scheduled token rotation occurs. The default rotation window is unbound and the minimum allowable window is 3600. Requires Vault Enterprise 1.19+. Available only for Vault Enterprise

Link copied to clipboard
val tenantId: Output<String>? = null

The tenant id for the Azure Active Directory organization.

Functions

Link copied to clipboard
open override fun toJava(): AuthBackendConfigArgs