Auth
Provides a resource to configure the GCP auth backend within Vault.
Example Usage
You can setup the GCP auth backend with Workload Identity Federation (WIF) for a secret-less configuration:
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const gcp = new vault.gcp.AuthBackend("gcp", {
identityTokenKey: "example-key",
identityTokenTtl: 1800,
identityTokenAudience: "<TOKEN_AUDIENCE>",
serviceAccountEmail: "<SERVICE_ACCOUNT_EMAIL>",
rotationSchedule: "0 * * * SAT",
rotationWindow: 3600,
});import pulumi
import pulumi_vault as vault
gcp = vault.gcp.AuthBackend("gcp",
identity_token_key="example-key",
identity_token_ttl=1800,
identity_token_audience="<TOKEN_AUDIENCE>",
service_account_email="<SERVICE_ACCOUNT_EMAIL>",
rotation_schedule="0 * * * SAT",
rotation_window=3600)using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
var gcp = new Vault.Gcp.AuthBackend("gcp", new()
{
IdentityTokenKey = "example-key",
IdentityTokenTtl = 1800,
IdentityTokenAudience = "<TOKEN_AUDIENCE>",
ServiceAccountEmail = "<SERVICE_ACCOUNT_EMAIL>",
RotationSchedule = "0 * * * SAT",
RotationWindow = 3600,
});
});package main
import (
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/gcp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := gcp.NewAuthBackend(ctx, "gcp", &gcp.AuthBackendArgs{
IdentityTokenKey: pulumi.String("example-key"),
IdentityTokenTtl: pulumi.Int(1800),
IdentityTokenAudience: pulumi.String("<TOKEN_AUDIENCE>"),
ServiceAccountEmail: pulumi.String("<SERVICE_ACCOUNT_EMAIL>"),
RotationSchedule: pulumi.String("0 * * * SAT"),
RotationWindow: pulumi.Int(3600),
})
if err != nil {
return err
}
return nil
})
}package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.gcp.AuthBackend;
import com.pulumi.vault.gcp.AuthBackendArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var gcp = new AuthBackend("gcp", AuthBackendArgs.builder()
.identityTokenKey("example-key")
.identityTokenTtl(1800)
.identityTokenAudience("<TOKEN_AUDIENCE>")
.serviceAccountEmail("<SERVICE_ACCOUNT_EMAIL>")
.rotationSchedule("0 * * * SAT")
.rotationWindow(3600)
.build());
}
}resources:
gcp:
type: vault:gcp:AuthBackend
properties:
identityTokenKey: example-key
identityTokenTtl: 1800
identityTokenAudience: <TOKEN_AUDIENCE>
serviceAccountEmail: <SERVICE_ACCOUNT_EMAIL>
rotationSchedule: 0 * * * SAT
rotationWindow: 3600Import
GCP authentication backends can be imported using the backend name, e.g.
$ pulumi import vault:gcp/authBackend:AuthBackend gcp gcpConstructors
Properties
The clients email associated with the credentials
A JSON string containing the contents of a GCP credentials file. If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running.
Specifies overrides to service endpoints used when making API requests. This allows specific requests made during authentication to target alternative service endpoints for use in Private Google Access environments. Requires Vault 1.11+. Overrides are set at the subdomain level using the following keys:
A description of the auth method.
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
If set, opts out of mount migration on path updates. See here for more info on Mount Migration
The audience claim value for plugin identity tokens. Must match an allowed audience configured for the target Workload Identity Pool. Mutually exclusive with credentials. Requires Vault 1.17+. Available only for Vault Enterprise.
The key to use for signing plugin identity tokens. Requires Vault 1.17+. Available only for Vault Enterprise.
The TTL of generated tokens.
The ID of the private key from the credentials
The amount of time in seconds Vault should wait before rotating the root credential. A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
The schedule, in cron-style time format, defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
The maximum amount of time in seconds allowed to complete a rotation when a scheduled token rotation occurs. The default rotation window is unbound and the minimum allowable window is 3600. Requires Vault Enterprise 1.19+.
Service Account to impersonate for plugin workload identity federation. Required with identity_token_audience. Requires Vault 1.17+. Available only for Vault Enterprise.
Extra configuration block. Structure is documented below. The tune block is used to tune the auth backend: