Group
Creates an Identity Group Alias for Vault. The Identity secrets engine is the identity management solution for Vault. Group aliases allows entity membership in external groups to be managed semi-automatically. External group serves as a mapping to a group that is outside of the identity store. External groups can have one (and only one) alias. This alias should map to a notion of group that is outside of the identity store. For example, groups in LDAP, and teams in GitHub. A username in LDAP, belonging to a group in LDAP, can get its entity ID added as a member of a group in Vault automatically during logins and token renewals. This works only if the group in Vault is an external group and has an alias that maps to the group in LDAP. If the user is removed from the group in LDAP, that change gets reflected in Vault only upon the subsequent login or renewal operation.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const group = new vault.identity.Group("group", {
name: "test",
type: "external",
policies: ["test"],
});
const github = new vault.AuthBackend("github", {
type: "github",
path: "github",
});
const group_alias = new vault.identity.GroupAlias("group-alias", {
name: "Github_Team_Slug",
mountAccessor: github.accessor,
canonicalId: group.id,
});import pulumi
import pulumi_vault as vault
group = vault.identity.Group("group",
name="test",
type="external",
policies=["test"])
github = vault.AuthBackend("github",
type="github",
path="github")
group_alias = vault.identity.GroupAlias("group-alias",
name="Github_Team_Slug",
mount_accessor=github.accessor,
canonical_id=group.id)using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
var @group = new Vault.Identity.Group("group", new()
{
Name = "test",
Type = "external",
Policies = new[]
{
"test",
},
});
var github = new Vault.AuthBackend("github", new()
{
Type = "github",
Path = "github",
});
var group_alias = new Vault.Identity.GroupAlias("group-alias", new()
{
Name = "Github_Team_Slug",
MountAccessor = github.Accessor,
CanonicalId = @group.Id,
});
});package main
import (
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault"
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/identity"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
group, err := identity.NewGroup(ctx, "group", &identity.GroupArgs{
Name: pulumi.String("test"),
Type: pulumi.String("external"),
Policies: pulumi.StringArray{
pulumi.String("test"),
},
})
if err != nil {
return err
}
github, err := vault.NewAuthBackend(ctx, "github", &vault.AuthBackendArgs{
Type: pulumi.String("github"),
Path: pulumi.String("github"),
})
if err != nil {
return err
}
_, err = identity.NewGroupAlias(ctx, "group-alias", &identity.GroupAliasArgs{
Name: pulumi.String("Github_Team_Slug"),
MountAccessor: github.Accessor,
CanonicalId: group.ID(),
})
if err != nil {
return err
}
return nil
})
}package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.identity.Group;
import com.pulumi.vault.identity.GroupArgs;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.identity.GroupAlias;
import com.pulumi.vault.identity.GroupAliasArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var group = new Group("group", GroupArgs.builder()
.name("test")
.type("external")
.policies("test")
.build());
var github = new AuthBackend("github", AuthBackendArgs.builder()
.type("github")
.path("github")
.build());
var group_alias = new GroupAlias("group-alias", GroupAliasArgs.builder()
.name("Github_Team_Slug")
.mountAccessor(github.accessor())
.canonicalId(group.id())
.build());
}
}resources:
group:
type: vault:identity:Group
properties:
name: test
type: external
policies:
- test
github:
type: vault:AuthBackend
properties:
type: github
path: github
group-alias:
type: vault:identity:GroupAlias
properties:
name: Github_Team_Slug
mountAccessor: ${github.accessor}
canonicalId: ${group.id}Import
The group alias can be imported with the group alias id, for example:
$ pulumi import vault:identity/groupAlias:GroupAlias group-alias idGroup aliases can also be imported using the UUID of the alias record, e.g.
$ pulumi import vault:identity/groupAlias:GroupAlias alias_name 63104e20-88e4-11eb-8d04-cf7ac9d60157