pulumi-vault-kotlin/com.pulumi.vault.kv.kotlin/SecretV2

SecretV2

class SecretV2 : KotlinCustomResource

Writes a KV-V2 secret to a given path in Vault. For more information on Vault's KV-V2 secret backend see here.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const kvv2 = new vault.Mount("kvv2", {
    path: "kvv2",
    type: "kv",
    options: {
        version: "2",
    },
    description: "KV Version 2 secret engine mount",
});
const example = new vault.kv.SecretV2("example", {
    mount: kvv2.path,
    name: "secret",
    cas: 1,
    deleteAllVersions: true,
    dataJson: JSON.stringify({
        zip: "zap",
        foo: "bar",
    }),
    customMetadata: {
        maxVersions: 5,
        data: {
            foo: "vault@example.com",
            bar: "12345",
        },
    },
});

import pulumi
import json
import pulumi_vault as vault
kvv2 = vault.Mount("kvv2",
    path="kvv2",
    type="kv",
    options={
        "version": "2",
    },
    description="KV Version 2 secret engine mount")
example = vault.kv.SecretV2("example",
    mount=kvv2.path,
    name="secret",
    cas=1,
    delete_all_versions=True,
    data_json=json.dumps({
        "zip": "zap",
        "foo": "bar",
    }),
    custom_metadata={
        "max_versions": 5,
        "data": {
            "foo": "vault@example.com",
            "bar": "12345",
        },
    })

using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
    var kvv2 = new Vault.Mount("kvv2", new()
    {
        Path = "kvv2",
        Type = "kv",
        Options =
        {
            { "version", "2" },
        },
        Description = "KV Version 2 secret engine mount",
    });
    var example = new Vault.Kv.SecretV2("example", new()
    {
        Mount = kvv2.Path,
        Name = "secret",
        Cas = 1,
        DeleteAllVersions = true,
        DataJson = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["zip"] = "zap",
            ["foo"] = "bar",
        }),
        CustomMetadata = new Vault.kv.Inputs.SecretV2CustomMetadataArgs
        {
            MaxVersions = 5,
            Data =
            {
                { "foo", "vault@example.com" },
                { "bar", "12345" },
            },
        },
    });
});

package main
import (
	"encoding/json"
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/kv"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		kvv2, err := vault.NewMount(ctx, "kvv2", &vault.MountArgs{
			Path: pulumi.String("kvv2"),
			Type: pulumi.String("kv"),
			Options: pulumi.StringMap{
				"version": pulumi.String("2"),
			},
			Description: pulumi.String("KV Version 2 secret engine mount"),
		})
		if err != nil {
			return err
		}
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"zip": "zap",
			"foo": "bar",
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		_, err = kv.NewSecretV2(ctx, "example", &kv.SecretV2Args{
			Mount:             kvv2.Path,
			Name:              pulumi.String("secret"),
			Cas:               pulumi.Int(1),
			DeleteAllVersions: pulumi.Bool(true),
			DataJson:          pulumi.String(json0),
			CustomMetadata: &kv.SecretV2CustomMetadataArgs{
				MaxVersions: pulumi.Int(5),
				Data: pulumi.StringMap{
					"foo": pulumi.String("vault@example.com"),
					"bar": pulumi.String("12345"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.kv.SecretV2;
import com.pulumi.vault.kv.SecretV2Args;
import com.pulumi.vault.kv.inputs.SecretV2CustomMetadataArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var kvv2 = new Mount("kvv2", MountArgs.builder()
            .path("kvv2")
            .type("kv")
            .options(Map.of("version", "2"))
            .description("KV Version 2 secret engine mount")
            .build());
        var example = new SecretV2("example", SecretV2Args.builder()
            .mount(kvv2.path())
            .name("secret")
            .cas(1)
            .deleteAllVersions(true)
            .dataJson(serializeJson(
                jsonObject(
                    jsonProperty("zip", "zap"),
                    jsonProperty("foo", "bar")
                )))
            .customMetadata(SecretV2CustomMetadataArgs.builder()
                .maxVersions(5)
                .data(Map.ofEntries(
                    Map.entry("foo", "vault@example.com"),
                    Map.entry("bar", "12345")
                ))
                .build())
            .build());
    }
}

resources:
  kvv2:
    type: vault:Mount
    properties:
      path: kvv2
      type: kv
      options:
        version: '2'
      description: KV Version 2 secret engine mount
  example:
    type: vault:kv:SecretV2
    properties:
      mount: ${kvv2.path}
      name: secret
      cas: 1
      deleteAllVersions: true
      dataJson:
        fn::toJSON:
          zip: zap
          foo: bar
      customMetadata:
        maxVersions: 5
        data:
          foo: vault@example.com
          bar: '12345'

Required Vault Capabilities

Use of this resource requires the create or update capability (depending on whether the resource already exists) on the given path, the delete capability if the resource is removed from configuration, and the read capability for drift detection (by default).

Custom Metadata Configuration Options

max_versions - (Optional) The number of versions to keep per key.
cas_required - (Optional) If true, all keys will require the cas parameter to be set on all write requests.
delete_version_after - (Optional) If set, specifies the length of time before a version is deleted. Accepts duration in integer seconds.
data - (Optional) A string to string map describing the secret.

Import

KV-V2 secrets can be imported using the path, e.g.

$ pulumi import vault:kv/secretV2:SecretV2 example kvv2/data/secret

Properties

cas

val cas: Output<Int>?

This flag is required if cas_required is set to true on either the secret or the engine's config. In order for a write operation to be successful, cas must be set to the current version of the secret.

customMetadata

val customMetadata: Output<SecretV2CustomMetadata>

A nested block that allows configuring metadata for the KV secret. Refer to the Configuration Options for more info.

data

val data: Output<Map<String, String>>

A mapping whose keys are the top-level data keys returned from Vault and whose values are the corresponding values. This map can only represent string data, so any non-string values returned from Vault are serialized as JSON.

dataJson

val dataJson: Output<String>

JSON-encoded string that will be written as the secret data at the given path.

deleteAllVersions

val deleteAllVersions: Output<Boolean>?

If set to true, permanently deletes all versions for the specified key.

disableRead

val disableRead: Output<Boolean>?

If set to true, disables reading secret from Vault; note: drift won't be detected.

val id: Output<String>

metadata

val metadata: Output<Map<String, String>>

Metadata associated with this secret read from Vault.

mount

val mount: Output<String>

Path where KV-V2 engine is mounted.

name

val name: Output<String>

Full name of the secret. For a nested secret the name is the nested path excluding the mount and data prefix. For example, for a secret at kvv2/data/foo/bar/baz the name is foo/bar/baz.

namespace

val namespace: Output<String>?

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

options

val options: Output<Map<String, String>>?

An object that holds option settings.

path

val path: Output<String>

Full path where the KV-V2 secret will be written.

pulumiChildResources

val pulumiChildResources: Set<KotlinResource>

pulumiResourceName

val pulumiResourceName: String

pulumiResourceType

val pulumiResourceType: String

urn

val urn: Output<String>