SecretBackendKeyArgs

data class SecretBackendKeyArgs(val allowPlaintextBackup: Output<Boolean>? = null, val autoRotatePeriod: Output<Int>? = null, val backend: Output<String>? = null, val convergentEncryption: Output<Boolean>? = null, val deletionAllowed: Output<Boolean>? = null, val derived: Output<Boolean>? = null, val exportable: Output<Boolean>? = null, val hybridKeyTypeEc: Output<String>? = null, val hybridKeyTypePqc: Output<String>? = null, val keySize: Output<Int>? = null, val minDecryptionVersion: Output<Int>? = null, val minEncryptionVersion: Output<Int>? = null, val name: Output<String>? = null, val namespace: Output<String>? = null, val parameterSet: Output<String>? = null, val type: Output<String>? = null) : ConvertibleToJava<SecretBackendKeyArgs>

Creates an Encryption Keyring on a Transit Secret Backend for Vault.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const transit = new vault.Mount("transit", {
path: "transit",
type: "transit",
description: "Example description",
defaultLeaseTtlSeconds: 3600,
maxLeaseTtlSeconds: 86400,
});
const key = new vault.transit.SecretBackendKey("key", {
backend: transit.path,
name: "my_key",
});
import pulumi
import pulumi_vault as vault
transit = vault.Mount("transit",
path="transit",
type="transit",
description="Example description",
default_lease_ttl_seconds=3600,
max_lease_ttl_seconds=86400)
key = vault.transit.SecretBackendKey("key",
backend=transit.path,
name="my_key")
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
var transit = new Vault.Mount("transit", new()
{
Path = "transit",
Type = "transit",
Description = "Example description",
DefaultLeaseTtlSeconds = 3600,
MaxLeaseTtlSeconds = 86400,
});
var key = new Vault.Transit.SecretBackendKey("key", new()
{
Backend = transit.Path,
Name = "my_key",
});
});
package main
import (
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault"
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/transit"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
transit, err := vault.NewMount(ctx, "transit", &vault.MountArgs{
Path: pulumi.String("transit"),
Type: pulumi.String("transit"),
Description: pulumi.String("Example description"),
DefaultLeaseTtlSeconds: pulumi.Int(3600),
MaxLeaseTtlSeconds: pulumi.Int(86400),
})
if err != nil {
return err
}
_, err = transit.NewSecretBackendKey(ctx, "key", &transit.SecretBackendKeyArgs{
Backend: transit.Path,
Name: pulumi.String("my_key"),
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.transit.SecretBackendKey;
import com.pulumi.vault.transit.SecretBackendKeyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var transit = new Mount("transit", MountArgs.builder()
.path("transit")
.type("transit")
.description("Example description")
.defaultLeaseTtlSeconds(3600)
.maxLeaseTtlSeconds(86400)
.build());
var key = new SecretBackendKey("key", SecretBackendKeyArgs.builder()
.backend(transit.path())
.name("my_key")
.build());
}
}
resources:
transit:
type: vault:Mount
properties:
path: transit
type: transit
description: Example description
defaultLeaseTtlSeconds: 3600
maxLeaseTtlSeconds: 86400
key:
type: vault:transit:SecretBackendKey
properties:
backend: ${transit.path}
name: my_key

Import

Transit secret backend keys can be imported using the path, e.g.

$ pulumi import vault:transit/secretBackendKey:SecretBackendKey key transit/keys/my_key

Constructors

Link copied to clipboard
constructor(allowPlaintextBackup: Output<Boolean>? = null, autoRotatePeriod: Output<Int>? = null, backend: Output<String>? = null, convergentEncryption: Output<Boolean>? = null, deletionAllowed: Output<Boolean>? = null, derived: Output<Boolean>? = null, exportable: Output<Boolean>? = null, hybridKeyTypeEc: Output<String>? = null, hybridKeyTypePqc: Output<String>? = null, keySize: Output<Int>? = null, minDecryptionVersion: Output<Int>? = null, minEncryptionVersion: Output<Int>? = null, name: Output<String>? = null, namespace: Output<String>? = null, parameterSet: Output<String>? = null, type: Output<String>? = null)

Properties

Link copied to clipboard
val allowPlaintextBackup: Output<Boolean>? = null

Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.

Link copied to clipboard
val autoRotatePeriod: Output<Int>? = null

Amount of seconds the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key.

Link copied to clipboard
val backend: Output<String>? = null

The path the transit secret backend is mounted at, with no leading or trailing /s.

Link copied to clipboard
val convergentEncryption: Output<Boolean>? = null

Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires derived to be set to true.

Link copied to clipboard
val deletionAllowed: Output<Boolean>? = null

Specifies if the key is allowed to be deleted.

Link copied to clipboard
val derived: Output<Boolean>? = null

Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.

Link copied to clipboard
val exportable: Output<Boolean>? = null

Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.

Link copied to clipboard
val hybridKeyTypeEc: Output<String>? = null

The elliptic curve algorithm to use for hybrid signatures. Supported key types are ecdsa-p256, ecdsa-p384, ecdsa-p521, and ed25519.

Link copied to clipboard
val hybridKeyTypePqc: Output<String>? = null

The post-quantum algorithm to use for hybrid signatures. Currently, ML-DSA is the only supported key type.

Link copied to clipboard
val keySize: Output<Int>? = null

The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.

Link copied to clipboard
val minDecryptionVersion: Output<Int>? = null

Minimum key version to use for decryption.

Link copied to clipboard
val minEncryptionVersion: Output<Int>? = null

Minimum key version to use for encryption

Link copied to clipboard
val name: Output<String>? = null

The name to identify this key within the backend. Must be unique within the backend.

Link copied to clipboard
val namespace: Output<String>? = null

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

Link copied to clipboard
val parameterSet: Output<String>? = null

The parameter set to use for ML-DSA. Required for ML-DSA and hybrid keys. Valid values are 44, 65, and 87.

Link copied to clipboard
val type: Output<String>? = null

Specifies the type of key to create. The currently-supported types are: aes128-gcm96, aes256-gcm96 (default), chacha20-poly1305, ed25519, ecdsa-p256, ecdsa-p384, ecdsa-p521, hmac, rsa-2048, rsa-3072 and rsa-4096.

Functions

Link copied to clipboard
open override fun toJava(): SecretBackendKeyArgs