Secret Backend Connection Args
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const db = new vault.Mount("db", {
path: "postgres",
type: "database",
});
const postgres = new vault.database.SecretBackendConnection("postgres", {
backend: db.path,
name: "postgres",
allowedRoles: [
"dev",
"prod",
],
rotationSchedule: "0 * * * SAT",
rotationWindow: 3600,
postgresql: {
connectionUrl: "postgres://username:password@host:port/database",
},
});
import pulumi
import pulumi_vault as vault
db = vault.Mount("db",
path="postgres",
type="database")
postgres = vault.database.SecretBackendConnection("postgres",
backend=db.path,
name="postgres",
allowed_roles=[
"dev",
"prod",
],
rotation_schedule="0 * * * SAT",
rotation_window=3600,
postgresql={
"connection_url": "postgres://username:password@host:port/database",
})
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
var db = new Vault.Mount("db", new()
{
Path = "postgres",
Type = "database",
});
var postgres = new Vault.Database.SecretBackendConnection("postgres", new()
{
Backend = db.Path,
Name = "postgres",
AllowedRoles = new[]
{
"dev",
"prod",
},
RotationSchedule = "0 * * * SAT",
RotationWindow = 3600,
Postgresql = new Vault.Database.Inputs.SecretBackendConnectionPostgresqlArgs
{
ConnectionUrl = "postgres://username:password@host:port/database",
},
});
});
package main
import (
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault"
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/database"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
db, err := vault.NewMount(ctx, "db", &vault.MountArgs{
Path: pulumi.String("postgres"),
Type: pulumi.String("database"),
})
if err != nil {
return err
}
_, err = database.NewSecretBackendConnection(ctx, "postgres", &database.SecretBackendConnectionArgs{
Backend: db.Path,
Name: pulumi.String("postgres"),
AllowedRoles: pulumi.StringArray{
pulumi.String("dev"),
pulumi.String("prod"),
},
RotationSchedule: pulumi.String("0 * * * SAT"),
RotationWindow: pulumi.Int(3600),
Postgresql: &database.SecretBackendConnectionPostgresqlArgs{
ConnectionUrl: pulumi.String("postgres://username:password@host:port/database"),
},
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.database.SecretBackendConnection;
import com.pulumi.vault.database.SecretBackendConnectionArgs;
import com.pulumi.vault.database.inputs.SecretBackendConnectionPostgresqlArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var db = new Mount("db", MountArgs.builder()
.path("postgres")
.type("database")
.build());
var postgres = new SecretBackendConnection("postgres", SecretBackendConnectionArgs.builder()
.backend(db.path())
.name("postgres")
.allowedRoles(
"dev",
"prod")
.rotationSchedule("0 * * * SAT")
.rotationWindow(3600)
.postgresql(SecretBackendConnectionPostgresqlArgs.builder()
.connectionUrl("postgres://username:password@host:port/database")
.build())
.build());
}
}
resources:
db:
type: vault:Mount
properties:
path: postgres
type: database
postgres:
type: vault:database:SecretBackendConnection
properties:
backend: ${db.path}
name: postgres
allowedRoles:
- dev
- prod
rotationSchedule: 0 * * * SAT
rotationWindow: 3600
postgresql:
connectionUrl: postgres://username:password@host:port/database
Import
Database secret backend connections can be imported using the backend
, /config/
, and the name
e.g.
$ pulumi import vault:database/secretBackendConnection:SecretBackendConnection example postgres/config/postgres
Constructors
Properties
A list of roles that are allowed to use this connection.
A nested block containing configuration options for Cassandra connections.
A nested block containing configuration options for Couchbase connections.
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
A nested block containing configuration options for Elasticsearch connections.
A nested block containing configuration options for SAP HanaDB connections.
A nested block containing configuration options for InfluxDB connections.
A nested block containing configuration options for MongoDB connections.
A nested block containing configuration options for MongoDB Atlas connections.
A nested block containing configuration options for MSSQL connections.
A nested block containing configuration options for MySQL connections.
A nested block containing configuration options for Aurora MySQL connections.
A nested block containing configuration options for legacy MySQL connections.
A nested block containing configuration options for RDS MySQL connections.
A nested block containing configuration options for Oracle connections.
Specifies the name of the plugin to use.
A nested block containing configuration options for PostgreSQL connections.
A nested block containing configuration options for Redis connections.
A nested block containing configuration options for Redis ElastiCache connections. Exactly one of the nested blocks of configuration options must be supplied.
Connection parameters for the redshift-database-plugin plugin.
A list of database statements to be executed to rotate the root user's credentials.
The amount of time in seconds Vault should wait before rotating the root credential. A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
The schedule, in cron-style time format, defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
The maximum amount of time in seconds allowed to complete a rotation when a scheduled token rotation occurs. The default rotation window is unbound and the minimum allowable window is 3600
. Requires Vault Enterprise 1.19+.
A nested block containing configuration options for Snowflake connections.
Whether the connection should be verified on initial configuration or not.