Secret
Creates a role on an PKI Secret Backend for Vault.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const pki = new vault.Mount("pki", {
path: "pki",
type: "pki",
defaultLeaseTtlSeconds: 3600,
maxLeaseTtlSeconds: 86400,
});
const role = new vault.pkisecret.SecretBackendRole("role", {
backend: pki.path,
name: "my_role",
ttl: "3600",
allowIpSans: true,
keyType: "rsa",
keyBits: 4096,
allowedDomains: [
"example.com",
"my.domain",
],
allowSubdomains: true,
});import pulumi
import pulumi_vault as vault
pki = vault.Mount("pki",
path="pki",
type="pki",
default_lease_ttl_seconds=3600,
max_lease_ttl_seconds=86400)
role = vault.pki_secret.SecretBackendRole("role",
backend=pki.path,
name="my_role",
ttl="3600",
allow_ip_sans=True,
key_type="rsa",
key_bits=4096,
allowed_domains=[
"example.com",
"my.domain",
],
allow_subdomains=True)using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
var pki = new Vault.Mount("pki", new()
{
Path = "pki",
Type = "pki",
DefaultLeaseTtlSeconds = 3600,
MaxLeaseTtlSeconds = 86400,
});
var role = new Vault.PkiSecret.SecretBackendRole("role", new()
{
Backend = pki.Path,
Name = "my_role",
Ttl = "3600",
AllowIpSans = true,
KeyType = "rsa",
KeyBits = 4096,
AllowedDomains = new[]
{
"example.com",
"my.domain",
},
AllowSubdomains = true,
});
});package main
import (
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault"
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/pkisecret"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
pki, err := vault.NewMount(ctx, "pki", &vault.MountArgs{
Path: pulumi.String("pki"),
Type: pulumi.String("pki"),
DefaultLeaseTtlSeconds: pulumi.Int(3600),
MaxLeaseTtlSeconds: pulumi.Int(86400),
})
if err != nil {
return err
}
_, err = pkisecret.NewSecretBackendRole(ctx, "role", &pkisecret.SecretBackendRoleArgs{
Backend: pki.Path,
Name: pulumi.String("my_role"),
Ttl: pulumi.String("3600"),
AllowIpSans: pulumi.Bool(true),
KeyType: pulumi.String("rsa"),
KeyBits: pulumi.Int(4096),
AllowedDomains: pulumi.StringArray{
pulumi.String("example.com"),
pulumi.String("my.domain"),
},
AllowSubdomains: pulumi.Bool(true),
})
if err != nil {
return err
}
return nil
})
}package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiSecret.SecretBackendRole;
import com.pulumi.vault.pkiSecret.SecretBackendRoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var pki = new Mount("pki", MountArgs.builder()
.path("pki")
.type("pki")
.defaultLeaseTtlSeconds(3600)
.maxLeaseTtlSeconds(86400)
.build());
var role = new SecretBackendRole("role", SecretBackendRoleArgs.builder()
.backend(pki.path())
.name("my_role")
.ttl("3600")
.allowIpSans(true)
.keyType("rsa")
.keyBits(4096)
.allowedDomains(
"example.com",
"my.domain")
.allowSubdomains(true)
.build());
}
}resources:
pki:
type: vault:Mount
properties:
path: pki
type: pki
defaultLeaseTtlSeconds: 3600
maxLeaseTtlSeconds: 86400
role:
type: vault:pkiSecret:SecretBackendRole
properties:
backend: ${pki.path}
name: my_role
ttl: 3600
allowIpSans: true
keyType: rsa
keyBits: 4096
allowedDomains:
- example.com
- my.domain
allowSubdomains: trueImport
PKI secret backend roles can be imported using the path, e.g.
$ pulumi import vault:pkiSecret/secretBackendRole:SecretBackendRole role pki/roles/my_roleConstructors
Properties
Flag to allow any name
Flag to allow certificates matching the actual domain
List of allowed domains for certificates
Flag, if set, allowed_domains can be specified using identity template expressions such as {{identity.entity.aliases.<mount accessor>.name}}.
Defines allowed custom SANs
An array of allowed serial numbers to put in Subject
Defines allowed URI SANs
Flag, if set, allowed_uri_sans can be specified using identity template expressions such as {{identity.entity.aliases.<mount accessor>.name}}.
Defines allowed User IDs
Flag to allow names containing glob patterns.
Flag to allow IP SANs
Flag to allow certificates for localhost
Flag to allow certificates matching subdomains
Flag to allow wildcard certificates.
Flag to mark basic constraints valid when issuing non-CA certificates
Flag to specify certificates for client use
Validations to run on the Common Name field of the certificate, choices: email, hostname, disabled
Flag to specify certificates for code signing use
Flag to specify certificates for email protection use
Flag to allow only valid host names
Specify the allowed extended key usage OIDs constraint on issued certificates
Specify the allowed extended key usage constraint on issued certificates
Flag to generate leases with certificates
The locality of generated certificates
Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs
Specifies the duration by which to backdate the NotBefore property.
The organization of generated certificates
The organization unit of generated certificates
(Vault 1.11+ only) A block for specifying policy identifers. The policy_identifier block can be repeated, and supports the following arguments:
Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use policy_identifier blocks instead
The postal code of generated certificates
Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the serial_number parameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the serial_number parameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior. Example usage:
Flag to specify certificates for server use
The number of bits to use in the signature algorithm
The street address of generated certificates
Flag to use the CN in the CSR
Flag to use the SANs in the CSR