Many resources are needed to download a project. Please understand that we have to compensate our server costs. Thank you in advance. Project price only 1 $
You can buy this project and download/modify it how often you want.
Build cloud applications and infrastructure by combining the safety and reliability of infrastructure as code with the power of the Kotlin programming language.
@file:Suppress("NAME_SHADOWING", "DEPRECATION")
package com.pulumi.vault.pkiSecret.kotlin
import com.pulumi.core.Output
import com.pulumi.core.Output.of
import com.pulumi.kotlin.ConvertibleToJava
import com.pulumi.kotlin.PulumiTagMarker
import com.pulumi.kotlin.applySuspend
import com.pulumi.vault.pkiSecret.SecretBackendRoleArgs.builder
import com.pulumi.vault.pkiSecret.kotlin.inputs.SecretBackendRolePolicyIdentifierArgs
import com.pulumi.vault.pkiSecret.kotlin.inputs.SecretBackendRolePolicyIdentifierArgsBuilder
import kotlin.Boolean
import kotlin.Int
import kotlin.String
import kotlin.Suppress
import kotlin.Unit
import kotlin.collections.List
import kotlin.jvm.JvmName
/**
* Creates a role on an PKI Secret Backend for Vault.
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as vault from "@pulumi/vault";
* const pki = new vault.Mount("pki", {
* path: "pki",
* type: "pki",
* defaultLeaseTtlSeconds: 3600,
* maxLeaseTtlSeconds: 86400,
* });
* const role = new vault.pkisecret.SecretBackendRole("role", {
* backend: pki.path,
* name: "my_role",
* ttl: "3600",
* allowIpSans: true,
* keyType: "rsa",
* keyBits: 4096,
* allowedDomains: [
* "example.com",
* "my.domain",
* ],
* allowSubdomains: true,
* });
* ```
* ```python
* import pulumi
* import pulumi_vault as vault
* pki = vault.Mount("pki",
* path="pki",
* type="pki",
* default_lease_ttl_seconds=3600,
* max_lease_ttl_seconds=86400)
* role = vault.pki_secret.SecretBackendRole("role",
* backend=pki.path,
* name="my_role",
* ttl="3600",
* allow_ip_sans=True,
* key_type="rsa",
* key_bits=4096,
* allowed_domains=[
* "example.com",
* "my.domain",
* ],
* allow_subdomains=True)
* ```
* ```csharp
* using System.Collections.Generic;
* using System.Linq;
* using Pulumi;
* using Vault = Pulumi.Vault;
* return await Deployment.RunAsync(() =>
* {
* var pki = new Vault.Mount("pki", new()
* {
* Path = "pki",
* Type = "pki",
* DefaultLeaseTtlSeconds = 3600,
* MaxLeaseTtlSeconds = 86400,
* });
* var role = new Vault.PkiSecret.SecretBackendRole("role", new()
* {
* Backend = pki.Path,
* Name = "my_role",
* Ttl = "3600",
* AllowIpSans = true,
* KeyType = "rsa",
* KeyBits = 4096,
* AllowedDomains = new[]
* {
* "example.com",
* "my.domain",
* },
* AllowSubdomains = true,
* });
* });
* ```
* ```go
* package main
* import (
* "github.com/pulumi/pulumi-vault/sdk/v6/go/vault"
* "github.com/pulumi/pulumi-vault/sdk/v6/go/vault/pkiSecret"
* "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
* )
* func main() {
* pulumi.Run(func(ctx *pulumi.Context) error {
* pki, err := vault.NewMount(ctx, "pki", &vault.MountArgs{
* Path: pulumi.String("pki"),
* Type: pulumi.String("pki"),
* DefaultLeaseTtlSeconds: pulumi.Int(3600),
* MaxLeaseTtlSeconds: pulumi.Int(86400),
* })
* if err != nil {
* return err
* }
* _, err = pkiSecret.NewSecretBackendRole(ctx, "role", &pkiSecret.SecretBackendRoleArgs{
* Backend: pki.Path,
* Name: pulumi.String("my_role"),
* Ttl: pulumi.String("3600"),
* AllowIpSans: pulumi.Bool(true),
* KeyType: pulumi.String("rsa"),
* KeyBits: pulumi.Int(4096),
* AllowedDomains: pulumi.StringArray{
* pulumi.String("example.com"),
* pulumi.String("my.domain"),
* },
* AllowSubdomains: pulumi.Bool(true),
* })
* if err != nil {
* return err
* }
* return nil
* })
* }
* ```
* ```java
* package generated_program;
* import com.pulumi.Context;
* import com.pulumi.Pulumi;
* import com.pulumi.core.Output;
* import com.pulumi.vault.Mount;
* import com.pulumi.vault.MountArgs;
* import com.pulumi.vault.pkiSecret.SecretBackendRole;
* import com.pulumi.vault.pkiSecret.SecretBackendRoleArgs;
* import java.util.List;
* import java.util.ArrayList;
* import java.util.Map;
* import java.io.File;
* import java.nio.file.Files;
* import java.nio.file.Paths;
* public class App {
* public static void main(String[] args) {
* Pulumi.run(App::stack);
* }
* public static void stack(Context ctx) {
* var pki = new Mount("pki", MountArgs.builder()
* .path("pki")
* .type("pki")
* .defaultLeaseTtlSeconds(3600)
* .maxLeaseTtlSeconds(86400)
* .build());
* var role = new SecretBackendRole("role", SecretBackendRoleArgs.builder()
* .backend(pki.path())
* .name("my_role")
* .ttl(3600)
* .allowIpSans(true)
* .keyType("rsa")
* .keyBits(4096)
* .allowedDomains(
* "example.com",
* "my.domain")
* .allowSubdomains(true)
* .build());
* }
* }
* ```
* ```yaml
* resources:
* pki:
* type: vault:Mount
* properties:
* path: pki
* type: pki
* defaultLeaseTtlSeconds: 3600
* maxLeaseTtlSeconds: 86400
* role:
* type: vault:pkiSecret:SecretBackendRole
* properties:
* backend: ${pki.path}
* name: my_role
* ttl: 3600
* allowIpSans: true
* keyType: rsa
* keyBits: 4096
* allowedDomains:
* - example.com
* - my.domain
* allowSubdomains: true
* ```
*
* ## Import
* PKI secret backend roles can be imported using the `path`, e.g.
* ```sh
* $ pulumi import vault:pkiSecret/secretBackendRole:SecretBackendRole role pki/roles/my_role
* ```
* @property allowAnyName Flag to allow any name
* @property allowBareDomains Flag to allow certificates matching the actual domain
* @property allowGlobDomains Flag to allow names containing glob patterns.
* @property allowIpSans Flag to allow IP SANs
* @property allowLocalhost Flag to allow certificates for localhost
* @property allowSubdomains Flag to allow certificates matching subdomains
* @property allowWildcardCertificates Flag to allow wildcard certificates.
* @property allowedDomains List of allowed domains for certificates
* @property allowedDomainsTemplate Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases..name}}`.
* @property allowedOtherSans Defines allowed custom SANs
* @property allowedSerialNumbers An array of allowed serial numbers to put in Subject
* @property allowedUriSans Defines allowed URI SANs
* @property allowedUriSansTemplate Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases..name}}`.
* @property allowedUserIds Defines allowed User IDs
* @property backend The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
* @property basicConstraintsValidForNonCa Flag to mark basic constraints valid when issuing non-CA certificates
* @property clientFlag Flag to specify certificates for client use
* @property codeSigningFlag Flag to specify certificates for code signing use
* @property countries The country of generated certificates
* @property emailProtectionFlag Flag to specify certificates for email protection use
* @property enforceHostnames Flag to allow only valid host names
* @property extKeyUsageOids Specify the allowed extended key usage OIDs constraint on issued certificates
* @property extKeyUsages Specify the allowed extended key usage constraint on issued certificates
* @property generateLease Flag to generate leases with certificates
* @property issuerRef Specifies the default issuer of this request. May
* be the value `default`, a name, or an issuer ID. Use ACLs to prevent access to
* the `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users
* overriding the role's `issuer_ref` value.
* @property keyBits The number of bits of generated keys
* @property keyType The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
* Defaults to `rsa`
* @property keyUsages Specify the allowed key usage constraint on issued
* certificates. Defaults to `["DigitalSignature", "KeyAgreement", "KeyEncipherment"])`.
* To specify no default key usage constraints, set this to an empty list `[]`.
* @property localities The locality of generated certificates
* @property maxTtl The maximum lease TTL, in seconds, for the role.
* @property name The name to identify this role within the backend. Must be unique within the backend.
* @property namespace The namespace to provision the resource in.
* The value should not contain leading or trailing forward slashes.
* The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
* *Available only for Vault Enterprise*.
* @property noStore Flag to not store certificates in the storage backend
* @property notBeforeDuration Specifies the duration by which to backdate the NotBefore property.
* @property organizationUnit The organization unit of generated certificates
* @property organizations The organization of generated certificates
* @property policyIdentifier (Vault 1.11+ only) A block for specifying policy identifers. The `policy_identifier` block can be repeated, and supports the following arguments:
* @property policyIdentifiers Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
* @property postalCodes The postal code of generated certificates
* @property provinces The province of generated certificates
* @property requireCn Flag to force CN usage
* @property serverFlag Flag to specify certificates for server use
* @property streetAddresses The street address of generated certificates
* @property ttl The TTL, in seconds, for any certificate issued against this role.
* @property useCsrCommonName Flag to use the CN in the CSR
* @property useCsrSans Flag to use the SANs in the CSR
*/
public data class SecretBackendRoleArgs(
public val allowAnyName: Output? = null,
public val allowBareDomains: Output? = null,
public val allowGlobDomains: Output? = null,
public val allowIpSans: Output? = null,
public val allowLocalhost: Output? = null,
public val allowSubdomains: Output? = null,
public val allowWildcardCertificates: Output? = null,
public val allowedDomains: Output>? = null,
public val allowedDomainsTemplate: Output? = null,
public val allowedOtherSans: Output>? = null,
public val allowedSerialNumbers: Output>? = null,
public val allowedUriSans: Output>? = null,
public val allowedUriSansTemplate: Output? = null,
public val allowedUserIds: Output>? = null,
public val backend: Output? = null,
public val basicConstraintsValidForNonCa: Output? = null,
public val clientFlag: Output? = null,
public val codeSigningFlag: Output? = null,
public val countries: Output>? = null,
public val emailProtectionFlag: Output? = null,
public val enforceHostnames: Output? = null,
public val extKeyUsageOids: Output>? = null,
public val extKeyUsages: Output>? = null,
public val generateLease: Output? = null,
public val issuerRef: Output? = null,
public val keyBits: Output? = null,
public val keyType: Output? = null,
public val keyUsages: Output>? = null,
public val localities: Output>? = null,
public val maxTtl: Output? = null,
public val name: Output? = null,
public val namespace: Output? = null,
public val noStore: Output? = null,
public val notBeforeDuration: Output? = null,
public val organizationUnit: Output>? = null,
public val organizations: Output>? = null,
public val policyIdentifier: Output>? = null,
public val policyIdentifiers: Output>? = null,
public val postalCodes: Output>? = null,
public val provinces: Output>? = null,
public val requireCn: Output? = null,
public val serverFlag: Output? = null,
public val streetAddresses: Output>? = null,
public val ttl: Output? = null,
public val useCsrCommonName: Output? = null,
public val useCsrSans: Output? = null,
) : ConvertibleToJava {
override fun toJava(): com.pulumi.vault.pkiSecret.SecretBackendRoleArgs =
com.pulumi.vault.pkiSecret.SecretBackendRoleArgs.builder()
.allowAnyName(allowAnyName?.applyValue({ args0 -> args0 }))
.allowBareDomains(allowBareDomains?.applyValue({ args0 -> args0 }))
.allowGlobDomains(allowGlobDomains?.applyValue({ args0 -> args0 }))
.allowIpSans(allowIpSans?.applyValue({ args0 -> args0 }))
.allowLocalhost(allowLocalhost?.applyValue({ args0 -> args0 }))
.allowSubdomains(allowSubdomains?.applyValue({ args0 -> args0 }))
.allowWildcardCertificates(allowWildcardCertificates?.applyValue({ args0 -> args0 }))
.allowedDomains(allowedDomains?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.allowedDomainsTemplate(allowedDomainsTemplate?.applyValue({ args0 -> args0 }))
.allowedOtherSans(allowedOtherSans?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.allowedSerialNumbers(allowedSerialNumbers?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.allowedUriSans(allowedUriSans?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.allowedUriSansTemplate(allowedUriSansTemplate?.applyValue({ args0 -> args0 }))
.allowedUserIds(allowedUserIds?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.backend(backend?.applyValue({ args0 -> args0 }))
.basicConstraintsValidForNonCa(basicConstraintsValidForNonCa?.applyValue({ args0 -> args0 }))
.clientFlag(clientFlag?.applyValue({ args0 -> args0 }))
.codeSigningFlag(codeSigningFlag?.applyValue({ args0 -> args0 }))
.countries(countries?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.emailProtectionFlag(emailProtectionFlag?.applyValue({ args0 -> args0 }))
.enforceHostnames(enforceHostnames?.applyValue({ args0 -> args0 }))
.extKeyUsageOids(extKeyUsageOids?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.extKeyUsages(extKeyUsages?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.generateLease(generateLease?.applyValue({ args0 -> args0 }))
.issuerRef(issuerRef?.applyValue({ args0 -> args0 }))
.keyBits(keyBits?.applyValue({ args0 -> args0 }))
.keyType(keyType?.applyValue({ args0 -> args0 }))
.keyUsages(keyUsages?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.localities(localities?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.maxTtl(maxTtl?.applyValue({ args0 -> args0 }))
.name(name?.applyValue({ args0 -> args0 }))
.namespace(namespace?.applyValue({ args0 -> args0 }))
.noStore(noStore?.applyValue({ args0 -> args0 }))
.notBeforeDuration(notBeforeDuration?.applyValue({ args0 -> args0 }))
.organizationUnit(organizationUnit?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.organizations(organizations?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.policyIdentifier(
policyIdentifier?.applyValue({ args0 ->
args0.map({ args0 ->
args0.let({ args0 ->
args0.toJava()
})
})
}),
)
.policyIdentifiers(policyIdentifiers?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.postalCodes(postalCodes?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.provinces(provinces?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.requireCn(requireCn?.applyValue({ args0 -> args0 }))
.serverFlag(serverFlag?.applyValue({ args0 -> args0 }))
.streetAddresses(streetAddresses?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.ttl(ttl?.applyValue({ args0 -> args0 }))
.useCsrCommonName(useCsrCommonName?.applyValue({ args0 -> args0 }))
.useCsrSans(useCsrSans?.applyValue({ args0 -> args0 })).build()
}
/**
* Builder for [SecretBackendRoleArgs].
*/
@PulumiTagMarker
public class SecretBackendRoleArgsBuilder internal constructor() {
private var allowAnyName: Output? = null
private var allowBareDomains: Output? = null
private var allowGlobDomains: Output? = null
private var allowIpSans: Output? = null
private var allowLocalhost: Output? = null
private var allowSubdomains: Output? = null
private var allowWildcardCertificates: Output? = null
private var allowedDomains: Output>? = null
private var allowedDomainsTemplate: Output? = null
private var allowedOtherSans: Output>? = null
private var allowedSerialNumbers: Output>? = null
private var allowedUriSans: Output>? = null
private var allowedUriSansTemplate: Output? = null
private var allowedUserIds: Output>? = null
private var backend: Output? = null
private var basicConstraintsValidForNonCa: Output? = null
private var clientFlag: Output? = null
private var codeSigningFlag: Output? = null
private var countries: Output>? = null
private var emailProtectionFlag: Output? = null
private var enforceHostnames: Output? = null
private var extKeyUsageOids: Output>? = null
private var extKeyUsages: Output>? = null
private var generateLease: Output? = null
private var issuerRef: Output? = null
private var keyBits: Output? = null
private var keyType: Output? = null
private var keyUsages: Output>? = null
private var localities: Output>? = null
private var maxTtl: Output? = null
private var name: Output? = null
private var namespace: Output? = null
private var noStore: Output? = null
private var notBeforeDuration: Output? = null
private var organizationUnit: Output>? = null
private var organizations: Output>? = null
private var policyIdentifier: Output>? = null
private var policyIdentifiers: Output>? = null
private var postalCodes: Output>? = null
private var provinces: Output>? = null
private var requireCn: Output? = null
private var serverFlag: Output? = null
private var streetAddresses: Output>? = null
private var ttl: Output? = null
private var useCsrCommonName: Output? = null
private var useCsrSans: Output? = null
/**
* @param value Flag to allow any name
*/
@JvmName("rconswhvjwiehvvi")
public suspend fun allowAnyName(`value`: Output) {
this.allowAnyName = value
}
/**
* @param value Flag to allow certificates matching the actual domain
*/
@JvmName("diqsqvwkoxdtrjeq")
public suspend fun allowBareDomains(`value`: Output) {
this.allowBareDomains = value
}
/**
* @param value Flag to allow names containing glob patterns.
*/
@JvmName("tlnraoagjawyyvhx")
public suspend fun allowGlobDomains(`value`: Output) {
this.allowGlobDomains = value
}
/**
* @param value Flag to allow IP SANs
*/
@JvmName("ptiswuclmxugkkmb")
public suspend fun allowIpSans(`value`: Output) {
this.allowIpSans = value
}
/**
* @param value Flag to allow certificates for localhost
*/
@JvmName("datyajhaocyyfaxe")
public suspend fun allowLocalhost(`value`: Output) {
this.allowLocalhost = value
}
/**
* @param value Flag to allow certificates matching subdomains
*/
@JvmName("ipfgulqnqgnemtsg")
public suspend fun allowSubdomains(`value`: Output) {
this.allowSubdomains = value
}
/**
* @param value Flag to allow wildcard certificates.
*/
@JvmName("bvuhvqiiqlopcwsr")
public suspend fun allowWildcardCertificates(`value`: Output) {
this.allowWildcardCertificates = value
}
/**
* @param value List of allowed domains for certificates
*/
@JvmName("mdbtrvnnplfgpbdr")
public suspend fun allowedDomains(`value`: Output>) {
this.allowedDomains = value
}
@JvmName("gubkmxbkaqsnqqko")
public suspend fun allowedDomains(vararg values: Output) {
this.allowedDomains = Output.all(values.asList())
}
/**
* @param values List of allowed domains for certificates
*/
@JvmName("jroqltqnptvhgokh")
public suspend fun allowedDomains(values: List