vault.gcp.SecretRoleset
Explore with Pulumi AI
Creates a Roleset in the GCP Secrets Engine for Vault.
Each Roleset is tied to a Service Account, and can have one or more bindings associated with it.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";
const project = "my-awesome-project";
const gcp = new vault.gcp.SecretBackend("gcp", {
path: "gcp",
credentials: std.file({
input: "credentials.json",
}).then(invoke => invoke.result),
});
const roleset = new vault.gcp.SecretRoleset("roleset", {
backend: gcp.path,
roleset: "project_viewer",
secretType: "access_token",
project: project,
tokenScopes: ["https://www.googleapis.com/auth/cloud-platform"],
bindings: [{
resource: `//cloudresourcemanager.googleapis.com/projects/${project}`,
roles: ["roles/viewer"],
}],
});
import pulumi
import pulumi_std as std
import pulumi_vault as vault
project = "my-awesome-project"
gcp = vault.gcp.SecretBackend("gcp",
path="gcp",
credentials=std.file(input="credentials.json").result)
roleset = vault.gcp.SecretRoleset("roleset",
backend=gcp.path,
roleset="project_viewer",
secret_type="access_token",
project=project,
token_scopes=["https://www.googleapis.com/auth/cloud-platform"],
bindings=[vault.gcp.SecretRolesetBindingArgs(
resource=f"//cloudresourcemanager.googleapis.com/projects/{project}",
roles=["roles/viewer"],
)])
package main
import (
"fmt"
"github.com/pulumi/pulumi-std/sdk/go/std"
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/gcp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
project := "my-awesome-project"
invokeFile, err := std.File(ctx, &std.FileArgs{
Input: "credentials.json",
}, nil)
if err != nil {
return err
}
gcp, err := gcp.NewSecretBackend(ctx, "gcp", &gcp.SecretBackendArgs{
Path: pulumi.String("gcp"),
Credentials: invokeFile.Result,
})
if err != nil {
return err
}
_, err = gcp.NewSecretRoleset(ctx, "roleset", &gcp.SecretRolesetArgs{
Backend: gcp.Path,
Roleset: pulumi.String("project_viewer"),
SecretType: pulumi.String("access_token"),
Project: pulumi.String(project),
TokenScopes: pulumi.StringArray{
pulumi.String("https://www.googleapis.com/auth/cloud-platform"),
},
Bindings: gcp.SecretRolesetBindingArray{
&gcp.SecretRolesetBindingArgs{
Resource: pulumi.String(fmt.Sprintf("//cloudresourcemanager.googleapis.com/projects/%v", project)),
Roles: pulumi.StringArray{
pulumi.String("roles/viewer"),
},
},
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
var project = "my-awesome-project";
var gcp = new Vault.Gcp.SecretBackend("gcp", new()
{
Path = "gcp",
Credentials = Std.File.Invoke(new()
{
Input = "credentials.json",
}).Apply(invoke => invoke.Result),
});
var roleset = new Vault.Gcp.SecretRoleset("roleset", new()
{
Backend = gcp.Path,
Roleset = "project_viewer",
SecretType = "access_token",
Project = project,
TokenScopes = new[]
{
"https://www.googleapis.com/auth/cloud-platform",
},
Bindings = new[]
{
new Vault.Gcp.Inputs.SecretRolesetBindingArgs
{
Resource = $"//cloudresourcemanager.googleapis.com/projects/{project}",
Roles = new[]
{
"roles/viewer",
},
},
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.gcp.SecretBackend;
import com.pulumi.vault.gcp.SecretBackendArgs;
import com.pulumi.vault.gcp.SecretRoleset;
import com.pulumi.vault.gcp.SecretRolesetArgs;
import com.pulumi.vault.gcp.inputs.SecretRolesetBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var project = "my-awesome-project";
var gcp = new SecretBackend("gcp", SecretBackendArgs.builder()
.path("gcp")
.credentials(StdFunctions.file(FileArgs.builder()
.input("credentials.json")
.build()).result())
.build());
var roleset = new SecretRoleset("roleset", SecretRolesetArgs.builder()
.backend(gcp.path())
.roleset("project_viewer")
.secretType("access_token")
.project(project)
.tokenScopes("https://www.googleapis.com/auth/cloud-platform")
.bindings(SecretRolesetBindingArgs.builder()
.resource(String.format("//cloudresourcemanager.googleapis.com/projects/%s", project))
.roles("roles/viewer")
.build())
.build());
}
}
resources:
gcp:
type: vault:gcp:SecretBackend
properties:
path: gcp
credentials:
fn::invoke:
Function: std:file
Arguments:
input: credentials.json
Return: result
roleset:
type: vault:gcp:SecretRoleset
properties:
backend: ${gcp.path}
roleset: project_viewer
secretType: access_token
project: ${project}
tokenScopes:
- https://www.googleapis.com/auth/cloud-platform
bindings:
- resource: //cloudresourcemanager.googleapis.com/projects/${project}
roles:
- roles/viewer
variables:
project: my-awesome-project
Create SecretRoleset Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new SecretRoleset(name: string, args: SecretRolesetArgs, opts?: CustomResourceOptions);
@overload
def SecretRoleset(resource_name: str,
args: SecretRolesetArgs,
opts: Optional[ResourceOptions] = None)
@overload
def SecretRoleset(resource_name: str,
opts: Optional[ResourceOptions] = None,
backend: Optional[str] = None,
bindings: Optional[Sequence[SecretRolesetBindingArgs]] = None,
project: Optional[str] = None,
roleset: Optional[str] = None,
namespace: Optional[str] = None,
secret_type: Optional[str] = None,
token_scopes: Optional[Sequence[str]] = None)
func NewSecretRoleset(ctx *Context, name string, args SecretRolesetArgs, opts ...ResourceOption) (*SecretRoleset, error)
public SecretRoleset(string name, SecretRolesetArgs args, CustomResourceOptions? opts = null)
public SecretRoleset(String name, SecretRolesetArgs args)
public SecretRoleset(String name, SecretRolesetArgs args, CustomResourceOptions options)
type: vault:gcp:SecretRoleset
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args SecretRolesetArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args SecretRolesetArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args SecretRolesetArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args SecretRolesetArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args SecretRolesetArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var secretRolesetResource = new Vault.Gcp.SecretRoleset("secretRolesetResource", new()
{
Backend = "string",
Bindings = new[]
{
new Vault.Gcp.Inputs.SecretRolesetBindingArgs
{
Resource = "string",
Roles = new[]
{
"string",
},
},
},
Project = "string",
Roleset = "string",
Namespace = "string",
SecretType = "string",
TokenScopes = new[]
{
"string",
},
});
example, err := gcp.NewSecretRoleset(ctx, "secretRolesetResource", &gcp.SecretRolesetArgs{
Backend: pulumi.String("string"),
Bindings: gcp.SecretRolesetBindingArray{
&gcp.SecretRolesetBindingArgs{
Resource: pulumi.String("string"),
Roles: pulumi.StringArray{
pulumi.String("string"),
},
},
},
Project: pulumi.String("string"),
Roleset: pulumi.String("string"),
Namespace: pulumi.String("string"),
SecretType: pulumi.String("string"),
TokenScopes: pulumi.StringArray{
pulumi.String("string"),
},
})
var secretRolesetResource = new SecretRoleset("secretRolesetResource", SecretRolesetArgs.builder()
.backend("string")
.bindings(SecretRolesetBindingArgs.builder()
.resource("string")
.roles("string")
.build())
.project("string")
.roleset("string")
.namespace("string")
.secretType("string")
.tokenScopes("string")
.build());
secret_roleset_resource = vault.gcp.SecretRoleset("secretRolesetResource",
backend="string",
bindings=[vault.gcp.SecretRolesetBindingArgs(
resource="string",
roles=["string"],
)],
project="string",
roleset="string",
namespace="string",
secret_type="string",
token_scopes=["string"])
const secretRolesetResource = new vault.gcp.SecretRoleset("secretRolesetResource", {
backend: "string",
bindings: [{
resource: "string",
roles: ["string"],
}],
project: "string",
roleset: "string",
namespace: "string",
secretType: "string",
tokenScopes: ["string"],
});
type: vault:gcp:SecretRoleset
properties:
backend: string
bindings:
- resource: string
roles:
- string
namespace: string
project: string
roleset: string
secretType: string
tokenScopes:
- string
SecretRoleset Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The SecretRoleset resource accepts the following input properties:
- Backend string
- Path where the GCP Secrets Engine is mounted
- Bindings
List<Secret
Roleset Binding> - Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- Project string
- Name of the GCP project that this roleset's service account will belong to.
- Roleset string
- Name of the Roleset to create
- Namespace string
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - Secret
Type string - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - Token
Scopes List<string> - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
- Backend string
- Path where the GCP Secrets Engine is mounted
- Bindings
[]Secret
Roleset Binding Args - Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- Project string
- Name of the GCP project that this roleset's service account will belong to.
- Roleset string
- Name of the Roleset to create
- Namespace string
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - Secret
Type string - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - Token
Scopes []string - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
- backend String
- Path where the GCP Secrets Engine is mounted
- bindings
List<Secret
Roleset Binding> - Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- project String
- Name of the GCP project that this roleset's service account will belong to.
- roleset String
- Name of the Roleset to create
- namespace String
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - secret
Type String - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - token
Scopes List<String> - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
- backend string
- Path where the GCP Secrets Engine is mounted
- bindings
Secret
Roleset Binding[] - Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- project string
- Name of the GCP project that this roleset's service account will belong to.
- roleset string
- Name of the Roleset to create
- namespace string
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - secret
Type string - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - token
Scopes string[] - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
- backend str
- Path where the GCP Secrets Engine is mounted
- bindings
Sequence[Secret
Roleset Binding Args] - Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- project str
- Name of the GCP project that this roleset's service account will belong to.
- roleset str
- Name of the Roleset to create
- namespace str
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - secret_
type str - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - token_
scopes Sequence[str] - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
- backend String
- Path where the GCP Secrets Engine is mounted
- bindings List<Property Map>
- Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- project String
- Name of the GCP project that this roleset's service account will belong to.
- roleset String
- Name of the Roleset to create
- namespace String
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - secret
Type String - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - token
Scopes List<String> - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
Outputs
All input properties are implicitly available as output properties. Additionally, the SecretRoleset resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Service
Account stringEmail - Email of the service account created by Vault for this Roleset.
- Id string
- The provider-assigned unique ID for this managed resource.
- Service
Account stringEmail - Email of the service account created by Vault for this Roleset.
- id String
- The provider-assigned unique ID for this managed resource.
- service
Account StringEmail - Email of the service account created by Vault for this Roleset.
- id string
- The provider-assigned unique ID for this managed resource.
- service
Account stringEmail - Email of the service account created by Vault for this Roleset.
- id str
- The provider-assigned unique ID for this managed resource.
- service_
account_ stremail - Email of the service account created by Vault for this Roleset.
- id String
- The provider-assigned unique ID for this managed resource.
- service
Account StringEmail - Email of the service account created by Vault for this Roleset.
Look up Existing SecretRoleset Resource
Get an existing SecretRoleset resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: SecretRolesetState, opts?: CustomResourceOptions): SecretRoleset
@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
backend: Optional[str] = None,
bindings: Optional[Sequence[SecretRolesetBindingArgs]] = None,
namespace: Optional[str] = None,
project: Optional[str] = None,
roleset: Optional[str] = None,
secret_type: Optional[str] = None,
service_account_email: Optional[str] = None,
token_scopes: Optional[Sequence[str]] = None) -> SecretRoleset
func GetSecretRoleset(ctx *Context, name string, id IDInput, state *SecretRolesetState, opts ...ResourceOption) (*SecretRoleset, error)
public static SecretRoleset Get(string name, Input<string> id, SecretRolesetState? state, CustomResourceOptions? opts = null)
public static SecretRoleset get(String name, Output<String> id, SecretRolesetState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Backend string
- Path where the GCP Secrets Engine is mounted
- Bindings
List<Secret
Roleset Binding> - Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- Namespace string
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - Project string
- Name of the GCP project that this roleset's service account will belong to.
- Roleset string
- Name of the Roleset to create
- Secret
Type string - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - Service
Account stringEmail - Email of the service account created by Vault for this Roleset.
- Token
Scopes List<string> - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
- Backend string
- Path where the GCP Secrets Engine is mounted
- Bindings
[]Secret
Roleset Binding Args - Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- Namespace string
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - Project string
- Name of the GCP project that this roleset's service account will belong to.
- Roleset string
- Name of the Roleset to create
- Secret
Type string - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - Service
Account stringEmail - Email of the service account created by Vault for this Roleset.
- Token
Scopes []string - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
- backend String
- Path where the GCP Secrets Engine is mounted
- bindings
List<Secret
Roleset Binding> - Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- namespace String
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - project String
- Name of the GCP project that this roleset's service account will belong to.
- roleset String
- Name of the Roleset to create
- secret
Type String - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - service
Account StringEmail - Email of the service account created by Vault for this Roleset.
- token
Scopes List<String> - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
- backend string
- Path where the GCP Secrets Engine is mounted
- bindings
Secret
Roleset Binding[] - Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- namespace string
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - project string
- Name of the GCP project that this roleset's service account will belong to.
- roleset string
- Name of the Roleset to create
- secret
Type string - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - service
Account stringEmail - Email of the service account created by Vault for this Roleset.
- token
Scopes string[] - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
- backend str
- Path where the GCP Secrets Engine is mounted
- bindings
Sequence[Secret
Roleset Binding Args] - Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- namespace str
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - project str
- Name of the GCP project that this roleset's service account will belong to.
- roleset str
- Name of the Roleset to create
- secret_
type str - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - service_
account_ stremail - Email of the service account created by Vault for this Roleset.
- token_
scopes Sequence[str] - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
- backend String
- Path where the GCP Secrets Engine is mounted
- bindings List<Property Map>
- Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.
- namespace String
- The namespace to provision the resource in.
The value should not contain leading or trailing forward slashes.
The
namespace
is always relative to the provider's configured namespace. Available only for Vault Enterprise. - project String
- Name of the GCP project that this roleset's service account will belong to.
- roleset String
- Name of the Roleset to create
- secret
Type String - Type of secret generated for this role set. Accepted values:
access_token
,service_account_key
. Defaults toaccess_token
. - service
Account StringEmail - Email of the service account created by Vault for this Roleset.
- token
Scopes List<String> - List of OAuth scopes to assign to
access_token
secrets generated under this role set (access_token
role sets only).
Supporting Types
SecretRolesetBinding, SecretRolesetBindingArgs
- Resource string
- Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
- Roles List<string>
- List of GCP IAM roles for the resource.
- Resource string
- Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
- Roles []string
- List of GCP IAM roles for the resource.
- resource String
- Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
- roles List<String>
- List of GCP IAM roles for the resource.
- resource string
- Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
- roles string[]
- List of GCP IAM roles for the resource.
- resource str
- Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
- roles Sequence[str]
- List of GCP IAM roles for the resource.
- resource String
- Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
- roles List<String>
- List of GCP IAM roles for the resource.
Import
A roleset can be imported using its Vault Path. For example, referencing the example above,
$ pulumi import vault:gcp/secretRoleset:SecretRoleset roleset gcp/roleset/project_viewer
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Vault pulumi/pulumi-vault
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
vault
Terraform Provider.