com.pulumi.vault.jwt.kotlin.AuthBackendRole.kt Maven / Gradle / Ivy
@file:Suppress("NAME_SHADOWING", "DEPRECATION")
package com.pulumi.vault.jwt.kotlin
import com.pulumi.core.Output
import com.pulumi.kotlin.KotlinCustomResource
import com.pulumi.kotlin.PulumiTagMarker
import com.pulumi.kotlin.ResourceMapper
import com.pulumi.kotlin.options.CustomResourceOptions
import com.pulumi.kotlin.options.CustomResourceOptionsBuilder
import com.pulumi.resources.Resource
import kotlin.Any
import kotlin.Boolean
import kotlin.Int
import kotlin.String
import kotlin.Suppress
import kotlin.Unit
import kotlin.collections.List
import kotlin.collections.Map
/**
* Builder for [AuthBackendRole].
*/
@PulumiTagMarker
public class AuthBackendRoleResourceBuilder internal constructor() {
public var name: String? = null
public var args: AuthBackendRoleArgs = AuthBackendRoleArgs()
public var opts: CustomResourceOptions = CustomResourceOptions()
/**
* @param name The _unique_ name of the resulting resource.
*/
public fun name(`value`: String) {
this.name = value
}
/**
* @param block The arguments to use to populate this resource's properties.
*/
public suspend fun args(block: suspend AuthBackendRoleArgsBuilder.() -> Unit) {
val builder = AuthBackendRoleArgsBuilder()
block(builder)
this.args = builder.build()
}
/**
* @param block A bag of options that control this resource's behavior.
*/
public suspend fun opts(block: suspend CustomResourceOptionsBuilder.() -> Unit) {
this.opts = com.pulumi.kotlin.options.CustomResourceOptions.opts(block)
}
internal fun build(): AuthBackendRole {
val builtJavaResource = com.pulumi.vault.jwt.AuthBackendRole(
this.name,
this.args.toJava(),
this.opts.toJava(),
)
return AuthBackendRole(builtJavaResource)
}
}
/**
* Manages an JWT/OIDC auth backend role in a Vault server. See the [Vault
* documentation](https://www.vaultproject.io/docs/auth/jwt.html) for more
* information.
* ## Example Usage
* Role for JWT backend:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as vault from "@pulumi/vault";
* const jwt = new vault.jwt.AuthBackend("jwt", {path: "jwt"});
* const example = new vault.jwt.AuthBackendRole("example", {
* backend: jwt.path,
* roleName: "test-role",
* tokenPolicies: [
* "default",
* "dev",
* "prod",
* ],
* boundAudiences: ["https://myco.test"],
* boundClaims: {
* color: "red,green,blue",
* },
* userClaim: "https://vault/user",
* roleType: "jwt",
* });
* ```
* ```python
* import pulumi
* import pulumi_vault as vault
* jwt = vault.jwt.AuthBackend("jwt", path="jwt")
* example = vault.jwt.AuthBackendRole("example",
* backend=jwt.path,
* role_name="test-role",
* token_policies=[
* "default",
* "dev",
* "prod",
* ],
* bound_audiences=["https://myco.test"],
* bound_claims={
* "color": "red,green,blue",
* },
* user_claim="https://vault/user",
* role_type="jwt")
* ```
* ```csharp
* using System.Collections.Generic;
* using System.Linq;
* using Pulumi;
* using Vault = Pulumi.Vault;
* return await Deployment.RunAsync(() =>
* {
* var jwt = new Vault.Jwt.AuthBackend("jwt", new()
* {
* Path = "jwt",
* });
* var example = new Vault.Jwt.AuthBackendRole("example", new()
* {
* Backend = jwt.Path,
* RoleName = "test-role",
* TokenPolicies = new[]
* {
* "default",
* "dev",
* "prod",
* },
* BoundAudiences = new[]
* {
* "https://myco.test",
* },
* BoundClaims =
* {
* { "color", "red,green,blue" },
* },
* UserClaim = "https://vault/user",
* RoleType = "jwt",
* });
* });
* ```
* ```go
* package main
* import (
* "github.com/pulumi/pulumi-vault/sdk/v6/go/vault/jwt"
* "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
* )
* func main() {
* pulumi.Run(func(ctx *pulumi.Context) error {
* jwt, err := jwt.NewAuthBackend(ctx, "jwt", &jwt.AuthBackendArgs{
* Path: pulumi.String("jwt"),
* })
* if err != nil {
* return err
* }
* _, err = jwt.NewAuthBackendRole(ctx, "example", &jwt.AuthBackendRoleArgs{
* Backend: jwt.Path,
* RoleName: pulumi.String("test-role"),
* TokenPolicies: pulumi.StringArray{
* pulumi.String("default"),
* pulumi.String("dev"),
* pulumi.String("prod"),
* },
* BoundAudiences: pulumi.StringArray{
* pulumi.String("https://myco.test"),
* },
* BoundClaims: pulumi.Map{
* "color": pulumi.Any("red,green,blue"),
* },
* UserClaim: pulumi.String("https://vault/user"),
* RoleType: pulumi.String("jwt"),
* })
* if err != nil {
* return err
* }
* return nil
* })
* }
* ```
* ```java
* package generated_program;
* import com.pulumi.Context;
* import com.pulumi.Pulumi;
* import com.pulumi.core.Output;
* import com.pulumi.vault.jwt.AuthBackend;
* import com.pulumi.vault.jwt.AuthBackendArgs;
* import com.pulumi.vault.jwt.AuthBackendRole;
* import com.pulumi.vault.jwt.AuthBackendRoleArgs;
* import java.util.List;
* import java.util.ArrayList;
* import java.util.Map;
* import java.io.File;
* import java.nio.file.Files;
* import java.nio.file.Paths;
* public class App {
* public static void main(String[] args) {
* Pulumi.run(App::stack);
* }
* public static void stack(Context ctx) {
* var jwt = new AuthBackend("jwt", AuthBackendArgs.builder()
* .path("jwt")
* .build());
* var example = new AuthBackendRole("example", AuthBackendRoleArgs.builder()
* .backend(jwt.path())
* .roleName("test-role")
* .tokenPolicies(
* "default",
* "dev",
* "prod")
* .boundAudiences("https://myco.test")
* .boundClaims(Map.of("color", "red,green,blue"))
* .userClaim("https://vault/user")
* .roleType("jwt")
* .build());
* }
* }
* ```
* ```yaml
* resources:
* jwt:
* type: vault:jwt:AuthBackend
* properties:
* path: jwt
* example:
* type: vault:jwt:AuthBackendRole
* properties:
* backend: ${jwt.path}
* roleName: test-role
* tokenPolicies:
* - default
* - dev
* - prod
* boundAudiences:
* - https://myco.test
* boundClaims:
* color: red,green,blue
* userClaim: https://vault/user
* roleType: jwt
* ```
*
* Role for OIDC backend:
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as vault from "@pulumi/vault";
* const oidc = new vault.jwt.AuthBackend("oidc", {
* path: "oidc",
* defaultRole: "test-role",
* });
* const example = new vault.jwt.AuthBackendRole("example", {
* backend: oidc.path,
* roleName: "test-role",
* tokenPolicies: [
* "default",
* "dev",
* "prod",
* ],
* userClaim: "https://vault/user",
* roleType: "oidc",
* allowedRedirectUris: ["http://localhost:8200/ui/vault/auth/oidc/oidc/callback"],
* });
* ```
* ```python
* import pulumi
* import pulumi_vault as vault
* oidc = vault.jwt.AuthBackend("oidc",
* path="oidc",
* default_role="test-role")
* example = vault.jwt.AuthBackendRole("example",
* backend=oidc.path,
* role_name="test-role",
* token_policies=[
* "default",
* "dev",
* "prod",
* ],
* user_claim="https://vault/user",
* role_type="oidc",
* allowed_redirect_uris=["http://localhost:8200/ui/vault/auth/oidc/oidc/callback"])
* ```
* ```csharp
* using System.Collections.Generic;
* using System.Linq;
* using Pulumi;
* using Vault = Pulumi.Vault;
* return await Deployment.RunAsync(() =>
* {
* var oidc = new Vault.Jwt.AuthBackend("oidc", new()
* {
* Path = "oidc",
* DefaultRole = "test-role",
* });
* var example = new Vault.Jwt.AuthBackendRole("example", new()
* {
* Backend = oidc.Path,
* RoleName = "test-role",
* TokenPolicies = new[]
* {
* "default",
* "dev",
* "prod",
* },
* UserClaim = "https://vault/user",
* RoleType = "oidc",
* AllowedRedirectUris = new[]
* {
* "http://localhost:8200/ui/vault/auth/oidc/oidc/callback",
* },
* });
* });
* ```
* ```go
* package main
* import (
* "github.com/pulumi/pulumi-vault/sdk/v6/go/vault/jwt"
* "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
* )
* func main() {
* pulumi.Run(func(ctx *pulumi.Context) error {
* oidc, err := jwt.NewAuthBackend(ctx, "oidc", &jwt.AuthBackendArgs{
* Path: pulumi.String("oidc"),
* DefaultRole: pulumi.String("test-role"),
* })
* if err != nil {
* return err
* }
* _, err = jwt.NewAuthBackendRole(ctx, "example", &jwt.AuthBackendRoleArgs{
* Backend: oidc.Path,
* RoleName: pulumi.String("test-role"),
* TokenPolicies: pulumi.StringArray{
* pulumi.String("default"),
* pulumi.String("dev"),
* pulumi.String("prod"),
* },
* UserClaim: pulumi.String("https://vault/user"),
* RoleType: pulumi.String("oidc"),
* AllowedRedirectUris: pulumi.StringArray{
* pulumi.String("http://localhost:8200/ui/vault/auth/oidc/oidc/callback"),
* },
* })
* if err != nil {
* return err
* }
* return nil
* })
* }
* ```
* ```java
* package generated_program;
* import com.pulumi.Context;
* import com.pulumi.Pulumi;
* import com.pulumi.core.Output;
* import com.pulumi.vault.jwt.AuthBackend;
* import com.pulumi.vault.jwt.AuthBackendArgs;
* import com.pulumi.vault.jwt.AuthBackendRole;
* import com.pulumi.vault.jwt.AuthBackendRoleArgs;
* import java.util.List;
* import java.util.ArrayList;
* import java.util.Map;
* import java.io.File;
* import java.nio.file.Files;
* import java.nio.file.Paths;
* public class App {
* public static void main(String[] args) {
* Pulumi.run(App::stack);
* }
* public static void stack(Context ctx) {
* var oidc = new AuthBackend("oidc", AuthBackendArgs.builder()
* .path("oidc")
* .defaultRole("test-role")
* .build());
* var example = new AuthBackendRole("example", AuthBackendRoleArgs.builder()
* .backend(oidc.path())
* .roleName("test-role")
* .tokenPolicies(
* "default",
* "dev",
* "prod")
* .userClaim("https://vault/user")
* .roleType("oidc")
* .allowedRedirectUris("http://localhost:8200/ui/vault/auth/oidc/oidc/callback")
* .build());
* }
* }
* ```
* ```yaml
* resources:
* oidc:
* type: vault:jwt:AuthBackend
* properties:
* path: oidc
* defaultRole: test-role
* example:
* type: vault:jwt:AuthBackendRole
* properties:
* backend: ${oidc.path}
* roleName: test-role
* tokenPolicies:
* - default
* - dev
* - prod
* userClaim: https://vault/user
* roleType: oidc
* allowedRedirectUris:
* - http://localhost:8200/ui/vault/auth/oidc/oidc/callback
* ```
*
* ## Import
* JWT authentication backend roles can be imported using the `path`, e.g.
* ```sh
* $ pulumi import vault:jwt/authBackendRole:AuthBackendRole example auth/jwt/role/test-role
* ```
*/
public class AuthBackendRole internal constructor(
override val javaResource: com.pulumi.vault.jwt.AuthBackendRole,
) : KotlinCustomResource(javaResource, AuthBackendRoleMapper) {
/**
* The list of allowed values for redirect_uri during OIDC logins.
* Required for OIDC roles
*/
public val allowedRedirectUris: Output>?
get() = javaResource.allowedRedirectUris().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 -> args0 })
}).orElse(null)
})
/**
* The unique name of the auth backend to configure.
* Defaults to `jwt`.
*/
public val backend: Output?
get() = javaResource.backend().applyValue({ args0 -> args0.map({ args0 -> args0 }).orElse(null) })
/**
* (Required for roles of type `jwt`, optional for roles of
* type `oidc`) List of `aud` claims to match against. Any match is sufficient.
*/
public val boundAudiences: Output>?
get() = javaResource.boundAudiences().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 -> args0 })
}).orElse(null)
})
/**
* If set, a map of claims to values to match against.
* A claim's value must be a string, which may contain one value or multiple
* comma-separated values, e.g. `"red"` or `"red,green,blue"`.
*/
public val boundClaims: Output>?
get() = javaResource.boundClaims().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 ->
args0.key.to(args0.value)
}).toMap()
}).orElse(null)
})
/**
* How to interpret values in the claims/values
* map (`bound_claims`): can be either `string` (exact match) or `glob` (wildcard
* match). Requires Vault 1.4.0 or above.
*/
public val boundClaimsType: Output
get() = javaResource.boundClaimsType().applyValue({ args0 -> args0 })
/**
* If set, requires that the `sub` claim matches
* this value.
*/
public val boundSubject: Output?
get() = javaResource.boundSubject().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* If set, a map of claims (keys) to be copied
* to specified metadata fields (values).
*/
public val claimMappings: Output>?
get() = javaResource.claimMappings().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 -> args0.key.to(args0.value) }).toMap()
}).orElse(null)
})
/**
* The amount of leeway to add to all claims to account for clock skew, in
* seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
* Only applicable with "jwt" roles.
*/
public val clockSkewLeeway: Output?
get() = javaResource.clockSkewLeeway().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* Disable bound claim value parsing. Useful when values contain commas.
*/
public val disableBoundClaimsParsing: Output?
get() = javaResource.disableBoundClaimsParsing().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* The amount of leeway to add to expiration (`exp`) claims to account for
* clock skew, in seconds. Defaults to `150` seconds if set to `0` and can be disabled if set to `-1`.
* Only applicable with "jwt" roles.
*/
public val expirationLeeway: Output?
get() = javaResource.expirationLeeway().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* The claim to use to uniquely identify
* the set of groups to which the user belongs; this will be used as the names
* for the Identity group aliases created due to a successful login. The claim
* value must be a list of strings.
*/
public val groupsClaim: Output?
get() = javaResource.groupsClaim().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* Specifies the allowable elapsed time in seconds since the last time
* the user was actively authenticated with the OIDC provider.
*/
public val maxAge: Output?
get() = javaResource.maxAge().applyValue({ args0 -> args0.map({ args0 -> args0 }).orElse(null) })
/**
* The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
*/
public val namespace: Output?
get() = javaResource.namespace().applyValue({ args0 -> args0.map({ args0 -> args0 }).orElse(null) })
/**
* The amount of leeway to add to not before (`nbf`) claims to account for
* clock skew, in seconds. Defaults to `150` seconds if set to `0` and can be disabled if set to `-1`.
* Only applicable with "jwt" roles.
*/
public val notBeforeLeeway: Output?
get() = javaResource.notBeforeLeeway().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* If set, a list of OIDC scopes to be used with an OIDC role.
* The standard scope "openid" is automatically included and need not be specified.
*/
public val oidcScopes: Output>?
get() = javaResource.oidcScopes().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 ->
args0
})
}).orElse(null)
})
/**
* The name of the role.
*/
public val roleName: Output
get() = javaResource.roleName().applyValue({ args0 -> args0 })
/**
* Type of role, either "oidc" (default) or "jwt".
*/
public val roleType: Output
get() = javaResource.roleType().applyValue({ args0 -> args0 })
/**
* Specifies the blocks of IP addresses which are allowed to use the generated token
*/
public val tokenBoundCidrs: Output>?
get() = javaResource.tokenBoundCidrs().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 -> args0 })
}).orElse(null)
})
/**
* Generated Token's Explicit Maximum TTL in seconds
*/
public val tokenExplicitMaxTtl: Output?
get() = javaResource.tokenExplicitMaxTtl().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* The maximum lifetime of the generated token
*/
public val tokenMaxTtl: Output?
get() = javaResource.tokenMaxTtl().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* If true, the 'default' policy will not automatically be added to generated tokens
*/
public val tokenNoDefaultPolicy: Output?
get() = javaResource.tokenNoDefaultPolicy().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* The maximum number of times a token may be used, a value of zero means unlimited
*/
public val tokenNumUses: Output?
get() = javaResource.tokenNumUses().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* Generated Token's Period
*/
public val tokenPeriod: Output?
get() = javaResource.tokenPeriod().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* Generated Token's Policies
*/
public val tokenPolicies: Output>?
get() = javaResource.tokenPolicies().applyValue({ args0 ->
args0.map({ args0 ->
args0.map({ args0 -> args0 })
}).orElse(null)
})
/**
* The initial ttl of the token to generate in seconds
*/
public val tokenTtl: Output?
get() = javaResource.tokenTtl().applyValue({ args0 -> args0.map({ args0 -> args0 }).orElse(null) })
/**
* The type of token to generate, service or batch
*/
public val tokenType: Output?
get() = javaResource.tokenType().applyValue({ args0 -> args0.map({ args0 -> args0 }).orElse(null) })
/**
* The claim to use to uniquely identify
* the user; this will be used as the name for the Identity entity alias created
* due to a successful login.
*/
public val userClaim: Output
get() = javaResource.userClaim().applyValue({ args0 -> args0 })
/**
* Specifies if the `user_claim` value uses
* [JSON pointer](https://www.vaultproject.io/docs/auth/jwt#claim-specifications-and-json-pointer)
* syntax for referencing claims. By default, the `user_claim` value will not use JSON pointer.
* Requires Vault 1.11+.
*/
public val userClaimJsonPointer: Output?
get() = javaResource.userClaimJsonPointer().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
/**
* Log received OIDC tokens and claims when debug-level
* logging is active. Not recommended in production since sensitive information may be present
* in OIDC responses.
*/
public val verboseOidcLogging: Output?
get() = javaResource.verboseOidcLogging().applyValue({ args0 ->
args0.map({ args0 ->
args0
}).orElse(null)
})
}
public object AuthBackendRoleMapper : ResourceMapper {
override fun supportsMappingOfType(javaResource: Resource): Boolean =
com.pulumi.vault.jwt.AuthBackendRole::class == javaResource::class
override fun map(javaResource: Resource): AuthBackendRole = AuthBackendRole(
javaResource as
com.pulumi.vault.jwt.AuthBackendRole,
)
}
/**
* @see [AuthBackendRole].
* @param name The _unique_ name of the resulting resource.
* @param block Builder for [AuthBackendRole].
*/
public suspend fun authBackendRole(
name: String,
block: suspend AuthBackendRoleResourceBuilder.() -> Unit,
): AuthBackendRole {
val builder = AuthBackendRoleResourceBuilder()
builder.name(name)
block(builder)
return builder.build()
}
/**
* @see [AuthBackendRole].
* @param name The _unique_ name of the resulting resource.
*/
public fun authBackendRole(name: String): AuthBackendRole {
val builder = AuthBackendRoleResourceBuilder()
builder.name(name)
return builder.build()
}
© 2015 - 2025 Weber Informatics LLC | Privacy Policy