pulumi-vault-kotlin/com.pulumi.vault.identity.kotlin/Group

Group

class Group : KotlinCustomResource

Creates an Identity Group for Vault. The Identity secrets engine is the identity management solution for Vault. A group can contain multiple entities as its members. A group can also have subgroups. Policies set on the group is granted to all members of the group. During request time, when the token's entity ID is being evaluated for the policies that it has access to; along with the policies on the entity itself, policies that are inherited due to group memberships are also granted.

Example Usage

Internal Group

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const internal = new vault.identity.Group("internal", {
    name: "internal",
    type: "internal",
    policies: [
        "dev",
        "test",
    ],
    metadata: {
        version: "2",
    },
});

import pulumi
import pulumi_vault as vault
internal = vault.identity.Group("internal",
    name="internal",
    type="internal",
    policies=[
        "dev",
        "test",
    ],
    metadata={
        "version": "2",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
    var @internal = new Vault.Identity.Group("internal", new()
    {
        Name = "internal",
        Type = "internal",
        Policies = new[]
        {
            "dev",
            "test",
        },
        Metadata =
        {
            { "version", "2" },
        },
    });
});

package main
import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/identity"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := identity.NewGroup(ctx, "internal", &identity.GroupArgs{
			Name: pulumi.String("internal"),
			Type: pulumi.String("internal"),
			Policies: pulumi.StringArray{
				pulumi.String("dev"),
				pulumi.String("test"),
			},
			Metadata: pulumi.StringMap{
				"version": pulumi.String("2"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.identity.Group;
import com.pulumi.vault.identity.GroupArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var internal = new Group("internal", GroupArgs.builder()
            .name("internal")
            .type("internal")
            .policies(
                "dev",
                "test")
            .metadata(Map.of("version", "2"))
            .build());
    }
}

resources:
  internal:
    type: vault:identity:Group
    properties:
      name: internal
      type: internal
      policies:
        - dev
        - test
      metadata:
        version: '2'

External Group

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const group = new vault.identity.Group("group", {
    name: "external",
    type: "external",
    policies: ["test"],
    metadata: {
        version: "1",
    },
});

import pulumi
import pulumi_vault as vault
group = vault.identity.Group("group",
    name="external",
    type="external",
    policies=["test"],
    metadata={
        "version": "1",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
    var @group = new Vault.Identity.Group("group", new()
    {
        Name = "external",
        Type = "external",
        Policies = new[]
        {
            "test",
        },
        Metadata =
        {
            { "version", "1" },
        },
    });
});

package main
import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/identity"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := identity.NewGroup(ctx, "group", &identity.GroupArgs{
			Name: pulumi.String("external"),
			Type: pulumi.String("external"),
			Policies: pulumi.StringArray{
				pulumi.String("test"),
			},
			Metadata: pulumi.StringMap{
				"version": pulumi.String("1"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.identity.Group;
import com.pulumi.vault.identity.GroupArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var group = new Group("group", GroupArgs.builder()
            .name("external")
            .type("external")
            .policies("test")
            .metadata(Map.of("version", "1"))
            .build());
    }
}

resources:
  group:
    type: vault:identity:Group
    properties:
      name: external
      type: external
      policies:
        - test
      metadata:
        version: '1'

Caveats

It's important to note that Vault identity groups names are case-insensitive. For example the following resources would be equivalent. Applying this configuration would result in the provider failing to create one of the identity groups, since the resources share the same name. This sort of pattern should be avoided:

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const internal = new vault.identity.Group("internal", {
    name: "internal",
    type: "internal",
    policies: [
        "dev",
        "test",
    ],
    metadata: {
        version: "2",
    },
});
const internalGroup = new vault.identity.Group("Internal", {
    name: "Internal",
    type: "internal",
    policies: [
        "dev",
        "test",
    ],
    metadata: {
        version: "2",
    },
});

import pulumi
import pulumi_vault as vault
internal = vault.identity.Group("internal",
    name="internal",
    type="internal",
    policies=[
        "dev",
        "test",
    ],
    metadata={
        "version": "2",
    })
internal_group = vault.identity.Group("Internal",
    name="Internal",
    type="internal",
    policies=[
        "dev",
        "test",
    ],
    metadata={
        "version": "2",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
    var @internal = new Vault.Identity.Group("internal", new()
    {
        Name = "internal",
        Type = "internal",
        Policies = new[]
        {
            "dev",
            "test",
        },
        Metadata =
        {
            { "version", "2" },
        },
    });
    var internalGroup = new Vault.Identity.Group("Internal", new()
    {
        Name = "Internal",
        Type = "internal",
        Policies = new[]
        {
            "dev",
            "test",
        },
        Metadata =
        {
            { "version", "2" },
        },
    });
});

package main
import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/identity"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := identity.NewGroup(ctx, "internal", &identity.GroupArgs{
			Name: pulumi.String("internal"),
			Type: pulumi.String("internal"),
			Policies: pulumi.StringArray{
				pulumi.String("dev"),
				pulumi.String("test"),
			},
			Metadata: pulumi.StringMap{
				"version": pulumi.String("2"),
			},
		})
		if err != nil {
			return err
		}
		_, err = identity.NewGroup(ctx, "Internal", &identity.GroupArgs{
			Name: pulumi.String("Internal"),
			Type: pulumi.String("internal"),
			Policies: pulumi.StringArray{
				pulumi.String("dev"),
				pulumi.String("test"),
			},
			Metadata: pulumi.StringMap{
				"version": pulumi.String("2"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.identity.Group;
import com.pulumi.vault.identity.GroupArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var internal = new Group("internal", GroupArgs.builder()
            .name("internal")
            .type("internal")
            .policies(
                "dev",
                "test")
            .metadata(Map.of("version", "2"))
            .build());
        var internalGroup = new Group("internalGroup", GroupArgs.builder()
            .name("Internal")
            .type("internal")
            .policies(
                "dev",
                "test")
            .metadata(Map.of("version", "2"))
            .build());
    }
}

resources:
  internal:
    type: vault:identity:Group
    properties:
      name: internal
      type: internal
      policies:
        - dev
        - test
      metadata:
        version: '2'
  internalGroup:
    type: vault:identity:Group
    name: Internal
    properties:
      name: Internal
      type: internal
      policies:
        - dev
        - test
      metadata:
        version: '2'

Import

Identity group can be imported using the id, e.g.

$ pulumi import vault:identity/group:Group test 'fcbf1efb-2b69-4209-bed8-811e3475dad3'

Properties

externalMemberEntityIds

val externalMemberEntityIds: Output<Boolean>?

false by default. If set to true, this resource will ignore any Entity IDs returned from Vault or specified in the resource. You can use vault.identity.GroupMemberEntityIds to manage Entity IDs for this group in a decoupled manner.

externalMemberGroupIds

val externalMemberGroupIds: Output<Boolean>?

false by default. If set to true, this resource will ignore any Group IDs returned from Vault or specified in the resource. You can use vault.identity.GroupMemberGroupIds to manage Group IDs for this group in a decoupled manner.

externalPolicies

val externalPolicies: Output<Boolean>?

false by default. If set to true, this resource will ignore any policies returned from Vault or specified in the resource. You can use vault.identity.GroupPolicies to manage policies for this group in a decoupled manner.

val id: Output<String>

memberEntityIds

val memberEntityIds: Output<List<String>>?

A list of Entity IDs to be assigned as group members. Not allowed on external groups.

memberGroupIds

val memberGroupIds: Output<List<String>>?

A list of Group IDs to be assigned as group members. Not allowed on external groups.

metadata

val metadata: Output<Map<String, String>>?

A Map of additional metadata to associate with the group.

name

val name: Output<String>

Name of the identity group to create.

namespace

val namespace: Output<String>?

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

policies

val policies: Output<List<String>>?

A list of policies to apply to the group.

pulumiChildResources

val pulumiChildResources: Set<KotlinResource>

pulumiResourceName

val pulumiResourceName: String

pulumiResourceType

val pulumiResourceType: String

type

val type: Output<String>?

Type of the group, internal or external. Defaults to internal.

urn

val urn: Output<String>