From 46b9d15c828fbaf627a66199807aed472b523cce Mon Sep 17 00:00:00 2001 From: Jordan Levin Date: Wed, 8 May 2024 15:05:17 -0700 Subject: [PATCH] revert to 2.45.0 Signed-off-by: Jordan Levin --- Makefile | 4 +- apis/ad/v1alpha1/zz_generated.deepcopy.go | 30 +++ apis/ad/v1alpha1/zz_secretbackend_types.go | 35 ++- .../cert/v1alpha1/zz_authbackendrole_types.go | 7 + apis/cert/v1alpha1/zz_generated.deepcopy.go | 33 +++ apis/consul/v1alpha1/zz_generated.deepcopy.go | 15 ++ .../v1alpha1/zz_secretbackendrole_types.go | 16 ++ .../v1alpha1/zz_generated.deepcopy.go | 5 + .../v1alpha1/zz_groupmemberentityids_types.go | 6 + apis/identity/v1alpha1/zz_oidcclient_types.go | 1 - .../v1alpha1/zz_generated.deepcopy.go | 15 -- .../v1alpha1/zz_secretbackendrole_types.go | 38 +-- .../v1alpha1/zz_secretrole_types.go | 12 +- apis/pki/v1alpha1/zz_generated.deepcopy.go | 30 +-- .../zz_secretbackendconfigurls_types.go | 13 -- .../zz_secretbackendrootcert_types.go | 4 + ...secretbackendrootsignintermediate_types.go | 3 + .../v1alpha1/zz_secretbackendsign_types.go | 4 + apis/ssh/v1alpha1/zz_generated.deepcopy.go | 45 ++++ .../v1alpha1/zz_secretbackendrole_types.go | 16 ++ .../transit/v1alpha1/zz_generated.deepcopy.go | 15 ++ .../v1alpha1/zz_secretbackendkey_types.go | 13 ++ config/provider-metadata.yaml | 217 +++--------------- config/schema.json | 2 +- .../mongodbatlas/secretbackend.yaml | 2 +- .../mongodbatlas/secretrole.yaml | 8 +- examples/providerconfig/providerconfig.yaml | 7 +- examples/providerconfig/secret.yaml.tmpl | 22 +- .../ad.vault.upbound.io_secretbackends.yaml | 42 +++- ...ert.vault.upbound.io_authbackendroles.yaml | 12 + ...l.vault.upbound.io_secretbackendroles.yaml | 21 ++ ....upbound.io_groupmemberentityidsidses.yaml | 6 + ...identity.vault.upbound.io_oidcclients.yaml | 3 +- ...s.vault.upbound.io_secretbackendroles.yaml | 61 ++--- ...odbatlas.vault.upbound.io_secretroles.yaml | 33 +-- ...lt.upbound.io_secretbackendconfigurls.yaml | 12 - ...ult.upbound.io_secretbackendrootcerts.yaml | 4 + ...io_secretbackendrootsignintermediates.yaml | 3 + ...i.vault.upbound.io_secretbackendsigns.yaml | 3 + ...h.vault.upbound.io_secretbackendroles.yaml | 21 ++ ...it.vault.upbound.io_secretbackendkeys.yaml | 15 ++ 41 files changed, 476 insertions(+), 378 deletions(-) diff --git a/Makefile b/Makefile index ed2331fc..fcd1c962 100644 --- a/Makefile +++ b/Makefile @@ -8,7 +8,7 @@ export TERRAFORM_VERSION := 1.5.5 export TERRAFORM_PROVIDER_SOURCE ?= hashicorp/vault export TERRAFORM_PROVIDER_REPO ?= https://github.com/hashicorp/terraform-provider-vault -export TERRAFORM_PROVIDER_VERSION ?= 4.2.0 +export TERRAFORM_PROVIDER_VERSION ?= 3.25.0 export TERRAFORM_PROVIDER_DOWNLOAD_NAME ?= terraform-provider-vault export TERRAFORM_DOCS_PATH ?= website/docs/r @@ -47,7 +47,7 @@ GO_SUBDIRS += cmd internal apis # Setup Kubernetes tools KIND_VERSION = v0.18.0 -UP_VERSION = v0.18.0 +UP_VERSION = v0.29.0 UP_CHANNEL = stable UPTEST_VERSION = v0.2.1 RELDIR = "examples/release" diff --git a/apis/ad/v1alpha1/zz_generated.deepcopy.go b/apis/ad/v1alpha1/zz_generated.deepcopy.go index d5acf584..bb0e6285 100644 --- a/apis/ad/v1alpha1/zz_generated.deepcopy.go +++ b/apis/ad/v1alpha1/zz_generated.deepcopy.go @@ -94,6 +94,11 @@ func (in *SecretBackendInitParameters) DeepCopyInto(out *SecretBackendInitParame *out = new(bool) **out = **in } + if in.Formatter != nil { + in, out := &in.Formatter, &out.Formatter + *out = new(string) + **out = **in + } if in.Groupattr != nil { in, out := &in.Groupattr, &out.Groupattr *out = new(string) @@ -119,6 +124,11 @@ func (in *SecretBackendInitParameters) DeepCopyInto(out *SecretBackendInitParame *out = new(float64) **out = **in } + if in.Length != nil { + in, out := &in.Length, &out.Length + *out = new(float64) + **out = **in + } if in.Local != nil { in, out := &in.Local, &out.Local *out = new(bool) @@ -296,6 +306,11 @@ func (in *SecretBackendObservation) DeepCopyInto(out *SecretBackendObservation) *out = new(bool) **out = **in } + if in.Formatter != nil { + in, out := &in.Formatter, &out.Formatter + *out = new(string) + **out = **in + } if in.Groupattr != nil { in, out := &in.Groupattr, &out.Groupattr *out = new(string) @@ -326,6 +341,11 @@ func (in *SecretBackendObservation) DeepCopyInto(out *SecretBackendObservation) *out = new(float64) **out = **in } + if in.Length != nil { + in, out := &in.Length, &out.Length + *out = new(float64) + **out = **in + } if in.Local != nil { in, out := &in.Local, &out.Local *out = new(bool) @@ -482,6 +502,11 @@ func (in *SecretBackendParameters) DeepCopyInto(out *SecretBackendParameters) { *out = new(bool) **out = **in } + if in.Formatter != nil { + in, out := &in.Formatter, &out.Formatter + *out = new(string) + **out = **in + } if in.Groupattr != nil { in, out := &in.Groupattr, &out.Groupattr *out = new(string) @@ -507,6 +532,11 @@ func (in *SecretBackendParameters) DeepCopyInto(out *SecretBackendParameters) { *out = new(float64) **out = **in } + if in.Length != nil { + in, out := &in.Length, &out.Length + *out = new(float64) + **out = **in + } if in.Local != nil { in, out := &in.Local, &out.Local *out = new(bool) diff --git a/apis/ad/v1alpha1/zz_secretbackend_types.go b/apis/ad/v1alpha1/zz_secretbackend_types.go index bf9df598..2a2b764a 100755 --- a/apis/ad/v1alpha1/zz_secretbackend_types.go +++ b/apis/ad/v1alpha1/zz_secretbackend_types.go @@ -61,6 +61,10 @@ type SecretBackendInitParameters struct { // Use anonymous bind to discover the bind DN of a user. Discoverdn *bool `json:"discoverdn,omitempty" tf:"discoverdn,omitempty"` + // Deprecated use password_policy. Text to insert the password into, ex. "customPrefix{{PASSWORD}}customSuffix". + // Text to insert the password into, ex. "customPrefix{{PASSWORD}}customSuffix". + Formatter *string `json:"formatter,omitempty" tf:"formatter,omitempty"` + // LDAP attribute to follow on objects returned by in order to enumerate // user group membership. Examples: cn or memberOf, etc. Defaults to cn. // LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: "cn" or "memberOf", etc. Default: cn @@ -85,6 +89,11 @@ type SecretBackendInitParameters struct { // The number of seconds after a Vault rotation where, if Active Directory shows a later rotation, it should be considered out-of-band. LastRotationTolerance *float64 `json:"lastRotationTolerance,omitempty" tf:"last_rotation_tolerance,omitempty"` + // Deprecated use password_policy. The desired length of passwords that Vault generates. + // Mutually exclusive with + // The desired length of passwords that Vault generates. + Length *float64 `json:"length,omitempty" tf:"length,omitempty"` + // Mark the secrets engine as local-only. Local engines are not replicated or removed by // replication.Tolerance duration to use when checking the last rotation time. // Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration to use when checking the last rotation time. @@ -105,7 +114,7 @@ type SecretBackendInitParameters struct { // Target namespace. (requires Enterprise) Namespace *string `json:"namespace,omitempty" tf:"namespace,omitempty"` - // Name of the password policy to use to generate passwords. + // 1.11+ // Name of the password policy to use to generate passwords. PasswordPolicy *string `json:"passwordPolicy,omitempty" tf:"password_policy,omitempty"` @@ -212,6 +221,10 @@ type SecretBackendObservation struct { // Use anonymous bind to discover the bind DN of a user. Discoverdn *bool `json:"discoverdn,omitempty" tf:"discoverdn,omitempty"` + // Deprecated use password_policy. Text to insert the password into, ex. "customPrefix{{PASSWORD}}customSuffix". + // Text to insert the password into, ex. "customPrefix{{PASSWORD}}customSuffix". + Formatter *string `json:"formatter,omitempty" tf:"formatter,omitempty"` + // LDAP attribute to follow on objects returned by in order to enumerate // user group membership. Examples: cn or memberOf, etc. Defaults to cn. // LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: "cn" or "memberOf", etc. Default: cn @@ -238,6 +251,11 @@ type SecretBackendObservation struct { // The number of seconds after a Vault rotation where, if Active Directory shows a later rotation, it should be considered out-of-band. LastRotationTolerance *float64 `json:"lastRotationTolerance,omitempty" tf:"last_rotation_tolerance,omitempty"` + // Deprecated use password_policy. The desired length of passwords that Vault generates. + // Mutually exclusive with + // The desired length of passwords that Vault generates. + Length *float64 `json:"length,omitempty" tf:"length,omitempty"` + // Mark the secrets engine as local-only. Local engines are not replicated or removed by // replication.Tolerance duration to use when checking the last rotation time. // Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration to use when checking the last rotation time. @@ -258,7 +276,7 @@ type SecretBackendObservation struct { // Target namespace. (requires Enterprise) Namespace *string `json:"namespace,omitempty" tf:"namespace,omitempty"` - // Name of the password policy to use to generate passwords. + // 1.11+ // Name of the password policy to use to generate passwords. PasswordPolicy *string `json:"passwordPolicy,omitempty" tf:"password_policy,omitempty"` @@ -390,6 +408,11 @@ type SecretBackendParameters struct { // +kubebuilder:validation:Optional Discoverdn *bool `json:"discoverdn,omitempty" tf:"discoverdn,omitempty"` + // Deprecated use password_policy. Text to insert the password into, ex. "customPrefix{{PASSWORD}}customSuffix". + // Text to insert the password into, ex. "customPrefix{{PASSWORD}}customSuffix". + // +kubebuilder:validation:Optional + Formatter *string `json:"formatter,omitempty" tf:"formatter,omitempty"` + // LDAP attribute to follow on objects returned by in order to enumerate // user group membership. Examples: cn or memberOf, etc. Defaults to cn. // LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: "cn" or "memberOf", etc. Default: cn @@ -419,6 +442,12 @@ type SecretBackendParameters struct { // +kubebuilder:validation:Optional LastRotationTolerance *float64 `json:"lastRotationTolerance,omitempty" tf:"last_rotation_tolerance,omitempty"` + // Deprecated use password_policy. The desired length of passwords that Vault generates. + // Mutually exclusive with + // The desired length of passwords that Vault generates. + // +kubebuilder:validation:Optional + Length *float64 `json:"length,omitempty" tf:"length,omitempty"` + // Mark the secrets engine as local-only. Local engines are not replicated or removed by // replication.Tolerance duration to use when checking the last rotation time. // Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration to use when checking the last rotation time. @@ -443,7 +472,7 @@ type SecretBackendParameters struct { // +kubebuilder:validation:Optional Namespace *string `json:"namespace,omitempty" tf:"namespace,omitempty"` - // Name of the password policy to use to generate passwords. + // 1.11+ // Name of the password policy to use to generate passwords. // +kubebuilder:validation:Optional PasswordPolicy *string `json:"passwordPolicy,omitempty" tf:"password_policy,omitempty"` diff --git a/apis/cert/v1alpha1/zz_authbackendrole_types.go b/apis/cert/v1alpha1/zz_authbackendrole_types.go index fcac7247..e8beb98f 100755 --- a/apis/cert/v1alpha1/zz_authbackendrole_types.go +++ b/apis/cert/v1alpha1/zz_authbackendrole_types.go @@ -22,6 +22,8 @@ type AuthBackendRoleInitParameters struct { AllowedNames []*string `json:"allowedNames,omitempty" tf:"allowed_names,omitempty"` + AllowedOrganizationUnits []*string `json:"allowedOrganizationUnits,omitempty" tf:"allowed_organization_units,omitempty"` + AllowedOrganizationalUnits []*string `json:"allowedOrganizationalUnits,omitempty" tf:"allowed_organizational_units,omitempty"` AllowedURISans []*string `json:"allowedUriSans,omitempty" tf:"allowed_uri_sans,omitempty"` @@ -91,6 +93,8 @@ type AuthBackendRoleObservation struct { AllowedNames []*string `json:"allowedNames,omitempty" tf:"allowed_names,omitempty"` + AllowedOrganizationUnits []*string `json:"allowedOrganizationUnits,omitempty" tf:"allowed_organization_units,omitempty"` + AllowedOrganizationalUnits []*string `json:"allowedOrganizationalUnits,omitempty" tf:"allowed_organizational_units,omitempty"` AllowedURISans []*string `json:"allowedUriSans,omitempty" tf:"allowed_uri_sans,omitempty"` @@ -167,6 +171,9 @@ type AuthBackendRoleParameters struct { // +kubebuilder:validation:Optional AllowedNames []*string `json:"allowedNames,omitempty" tf:"allowed_names,omitempty"` + // +kubebuilder:validation:Optional + AllowedOrganizationUnits []*string `json:"allowedOrganizationUnits,omitempty" tf:"allowed_organization_units,omitempty"` + // +kubebuilder:validation:Optional AllowedOrganizationalUnits []*string `json:"allowedOrganizationalUnits,omitempty" tf:"allowed_organizational_units,omitempty"` diff --git a/apis/cert/v1alpha1/zz_generated.deepcopy.go b/apis/cert/v1alpha1/zz_generated.deepcopy.go index 0c63c1bc..31654b24 100644 --- a/apis/cert/v1alpha1/zz_generated.deepcopy.go +++ b/apis/cert/v1alpha1/zz_generated.deepcopy.go @@ -87,6 +87,17 @@ func (in *AuthBackendRoleInitParameters) DeepCopyInto(out *AuthBackendRoleInitPa } } } + if in.AllowedOrganizationUnits != nil { + in, out := &in.AllowedOrganizationUnits, &out.AllowedOrganizationUnits + *out = make([]*string, len(*in)) + for i := range *in { + if (*in)[i] != nil { + in, out := &(*in)[i], &(*out)[i] + *out = new(string) + **out = **in + } + } + } if in.AllowedOrganizationalUnits != nil { in, out := &in.AllowedOrganizationalUnits, &out.AllowedOrganizationalUnits *out = make([]*string, len(*in)) @@ -324,6 +335,17 @@ func (in *AuthBackendRoleObservation) DeepCopyInto(out *AuthBackendRoleObservati } } } + if in.AllowedOrganizationUnits != nil { + in, out := &in.AllowedOrganizationUnits, &out.AllowedOrganizationUnits + *out = make([]*string, len(*in)) + for i := range *in { + if (*in)[i] != nil { + in, out := &(*in)[i], &(*out)[i] + *out = new(string) + **out = **in + } + } + } if in.AllowedOrganizationalUnits != nil { in, out := &in.AllowedOrganizationalUnits, &out.AllowedOrganizationalUnits *out = make([]*string, len(*in)) @@ -534,6 +556,17 @@ func (in *AuthBackendRoleParameters) DeepCopyInto(out *AuthBackendRoleParameters } } } + if in.AllowedOrganizationUnits != nil { + in, out := &in.AllowedOrganizationUnits, &out.AllowedOrganizationUnits + *out = make([]*string, len(*in)) + for i := range *in { + if (*in)[i] != nil { + in, out := &(*in)[i], &(*out)[i] + *out = new(string) + **out = **in + } + } + } if in.AllowedOrganizationalUnits != nil { in, out := &in.AllowedOrganizationalUnits, &out.AllowedOrganizationalUnits *out = make([]*string, len(*in)) diff --git a/apis/consul/v1alpha1/zz_generated.deepcopy.go b/apis/consul/v1alpha1/zz_generated.deepcopy.go index 6f4ddf92..0bb69d13 100644 --- a/apis/consul/v1alpha1/zz_generated.deepcopy.go +++ b/apis/consul/v1alpha1/zz_generated.deepcopy.go @@ -428,6 +428,11 @@ func (in *SecretBackendRoleInitParameters) DeepCopyInto(out *SecretBackendRoleIn *out = new(float64) **out = **in } + if in.TokenType != nil { + in, out := &in.TokenType, &out.TokenType + *out = new(string) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretBackendRoleInitParameters. @@ -575,6 +580,11 @@ func (in *SecretBackendRoleObservation) DeepCopyInto(out *SecretBackendRoleObser *out = new(float64) **out = **in } + if in.TokenType != nil { + in, out := &in.TokenType, &out.TokenType + *out = new(string) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretBackendRoleObservation. @@ -685,6 +695,11 @@ func (in *SecretBackendRoleParameters) DeepCopyInto(out *SecretBackendRoleParame *out = new(float64) **out = **in } + if in.TokenType != nil { + in, out := &in.TokenType, &out.TokenType + *out = new(string) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretBackendRoleParameters. diff --git a/apis/consul/v1alpha1/zz_secretbackendrole_types.go b/apis/consul/v1alpha1/zz_secretbackendrole_types.go index 2db15ac8..13791ebe 100755 --- a/apis/consul/v1alpha1/zz_secretbackendrole_types.go +++ b/apis/consul/v1alpha1/zz_secretbackendrole_types.go @@ -78,6 +78,11 @@ type SecretBackendRoleInitParameters struct { // Specifies the TTL for this role. // Specifies the TTL for this role. TTL *float64 `json:"ttl,omitempty" tf:"ttl,omitempty"` + + // Specifies the type of token to create when using this role. Valid values are "client" or "management". + // Deprecated: Consul 1.11 and later removed the legacy ACL system which supported this field. + // Specifies the type of token to create when using this role. Valid values are "client" or "management". + TokenType *string `json:"tokenType,omitempty" tf:"token_type,omitempty"` } type SecretBackendRoleObservation struct { @@ -147,6 +152,11 @@ type SecretBackendRoleObservation struct { // Specifies the TTL for this role. // Specifies the TTL for this role. TTL *float64 `json:"ttl,omitempty" tf:"ttl,omitempty"` + + // Specifies the type of token to create when using this role. Valid values are "client" or "management". + // Deprecated: Consul 1.11 and later removed the legacy ACL system which supported this field. + // Specifies the type of token to create when using this role. Valid values are "client" or "management". + TokenType *string `json:"tokenType,omitempty" tf:"token_type,omitempty"` } type SecretBackendRoleParameters struct { @@ -227,6 +237,12 @@ type SecretBackendRoleParameters struct { // Specifies the TTL for this role. // +kubebuilder:validation:Optional TTL *float64 `json:"ttl,omitempty" tf:"ttl,omitempty"` + + // Specifies the type of token to create when using this role. Valid values are "client" or "management". + // Deprecated: Consul 1.11 and later removed the legacy ACL system which supported this field. + // Specifies the type of token to create when using this role. Valid values are "client" or "management". + // +kubebuilder:validation:Optional + TokenType *string `json:"tokenType,omitempty" tf:"token_type,omitempty"` } // SecretBackendRoleSpec defines the desired state of SecretBackendRole diff --git a/apis/identity/v1alpha1/zz_generated.deepcopy.go b/apis/identity/v1alpha1/zz_generated.deepcopy.go index bdfb2034..0c816799 100644 --- a/apis/identity/v1alpha1/zz_generated.deepcopy.go +++ b/apis/identity/v1alpha1/zz_generated.deepcopy.go @@ -1240,6 +1240,11 @@ func (in *GroupMemberEntityIdsObservation) DeepCopyInto(out *GroupMemberEntityId *out = new(string) **out = **in } + if in.GroupName != nil { + in, out := &in.GroupName, &out.GroupName + *out = new(string) + **out = **in + } if in.ID != nil { in, out := &in.ID, &out.ID *out = new(string) diff --git a/apis/identity/v1alpha1/zz_groupmemberentityids_types.go b/apis/identity/v1alpha1/zz_groupmemberentityids_types.go index a5a1979b..188ae26a 100755 --- a/apis/identity/v1alpha1/zz_groupmemberentityids_types.go +++ b/apis/identity/v1alpha1/zz_groupmemberentityids_types.go @@ -47,6 +47,12 @@ type GroupMemberEntityIdsObservation struct { // ID of the group. GroupID *string `json:"groupId,omitempty" tf:"group_id,omitempty"` + // The name of the group that are assigned the member entities. + // Deprecated: The value for group_name may not always be accurate + // use data.vault_identity_group.*.group_name, or vault_identity_group.*.group_name instead. + // Name of the group. + GroupName *string `json:"groupName,omitempty" tf:"group_name,omitempty"` + ID *string `json:"id,omitempty" tf:"id,omitempty"` // List of member entities that belong to the group diff --git a/apis/identity/v1alpha1/zz_oidcclient_types.go b/apis/identity/v1alpha1/zz_oidcclient_types.go index 145ef412..f98a314c 100755 --- a/apis/identity/v1alpha1/zz_oidcclient_types.go +++ b/apis/identity/v1alpha1/zz_oidcclient_types.go @@ -67,7 +67,6 @@ type OidcClientObservation struct { // A list of assignment resources associated with the client. Assignments []*string `json:"assignments,omitempty" tf:"assignments,omitempty"` - // The Client ID returned by Vault. // The Client ID from Vault. ClientID *string `json:"clientId,omitempty" tf:"client_id,omitempty"` diff --git a/apis/kubernetes/v1alpha1/zz_generated.deepcopy.go b/apis/kubernetes/v1alpha1/zz_generated.deepcopy.go index 91c27e02..d78ed8c4 100644 --- a/apis/kubernetes/v1alpha1/zz_generated.deepcopy.go +++ b/apis/kubernetes/v1alpha1/zz_generated.deepcopy.go @@ -1215,11 +1215,6 @@ func (in *SecretBackendRole) DeepCopyObject() runtime.Object { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretBackendRoleInitParameters) DeepCopyInto(out *SecretBackendRoleInitParameters) { *out = *in - if in.AllowedKubernetesNamespaceSelector != nil { - in, out := &in.AllowedKubernetesNamespaceSelector, &out.AllowedKubernetesNamespaceSelector - *out = new(string) - **out = **in - } if in.AllowedKubernetesNamespaces != nil { in, out := &in.AllowedKubernetesNamespaces, &out.AllowedKubernetesNamespaces *out = make([]*string, len(*in)) @@ -1358,11 +1353,6 @@ func (in *SecretBackendRoleList) DeepCopyObject() runtime.Object { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretBackendRoleObservation) DeepCopyInto(out *SecretBackendRoleObservation) { *out = *in - if in.AllowedKubernetesNamespaceSelector != nil { - in, out := &in.AllowedKubernetesNamespaceSelector, &out.AllowedKubernetesNamespaceSelector - *out = new(string) - **out = **in - } if in.AllowedKubernetesNamespaces != nil { in, out := &in.AllowedKubernetesNamespaces, &out.AllowedKubernetesNamespaces *out = make([]*string, len(*in)) @@ -1474,11 +1464,6 @@ func (in *SecretBackendRoleObservation) DeepCopy() *SecretBackendRoleObservation // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *SecretBackendRoleParameters) DeepCopyInto(out *SecretBackendRoleParameters) { *out = *in - if in.AllowedKubernetesNamespaceSelector != nil { - in, out := &in.AllowedKubernetesNamespaceSelector, &out.AllowedKubernetesNamespaceSelector - *out = new(string) - **out = **in - } if in.AllowedKubernetesNamespaces != nil { in, out := &in.AllowedKubernetesNamespaces, &out.AllowedKubernetesNamespaces *out = make([]*string, len(*in)) diff --git a/apis/kubernetes/v1alpha1/zz_secretbackendrole_types.go b/apis/kubernetes/v1alpha1/zz_secretbackendrole_types.go index 93d29d57..452145b4 100755 --- a/apis/kubernetes/v1alpha1/zz_secretbackendrole_types.go +++ b/apis/kubernetes/v1alpha1/zz_secretbackendrole_types.go @@ -15,17 +15,9 @@ import ( type SecretBackendRoleInitParameters struct { - // A label selector for Kubernetes namespaces - // in which credentials can be generated. Accepts either a JSON or YAML object. The value should be - // of type LabelSelector. - // If set with allowed_kubernetes_namespace, the conditions are ORed. - // A label selector for Kubernetes namespaces in which credentials can begenerated. Accepts either a JSON or YAML object. The value should be of typeLabelSelector. If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed. - AllowedKubernetesNamespaceSelector *string `json:"allowedKubernetesNamespaceSelector,omitempty" tf:"allowed_kubernetes_namespace_selector,omitempty"` - // The list of Kubernetes namespaces this role - // can generate credentials for. If set to * all namespaces are allowed. If set with - // allowed_kubernetes_namespace_selector, the conditions are ORed. - // The list of Kubernetes namespaces this role can generate credentials for. If set to '*' all namespaces are allowed. If set with`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed. + // can generate credentials for. If set to * all namespaces are allowed. + // The list of Kubernetes namespaces this role can generate credentials for. If set to '*' all namespaces are allowed. AllowedKubernetesNamespaces []*string `json:"allowedKubernetesNamespaces,omitempty" tf:"allowed_kubernetes_namespaces,omitempty"` // The path of the Kubernetes Secrets Engine backend mount to create @@ -95,17 +87,9 @@ type SecretBackendRoleInitParameters struct { type SecretBackendRoleObservation struct { - // A label selector for Kubernetes namespaces - // in which credentials can be generated. Accepts either a JSON or YAML object. The value should be - // of type LabelSelector. - // If set with allowed_kubernetes_namespace, the conditions are ORed. - // A label selector for Kubernetes namespaces in which credentials can begenerated. Accepts either a JSON or YAML object. The value should be of typeLabelSelector. If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed. - AllowedKubernetesNamespaceSelector *string `json:"allowedKubernetesNamespaceSelector,omitempty" tf:"allowed_kubernetes_namespace_selector,omitempty"` - // The list of Kubernetes namespaces this role - // can generate credentials for. If set to * all namespaces are allowed. If set with - // allowed_kubernetes_namespace_selector, the conditions are ORed. - // The list of Kubernetes namespaces this role can generate credentials for. If set to '*' all namespaces are allowed. If set with`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed. + // can generate credentials for. If set to * all namespaces are allowed. + // The list of Kubernetes namespaces this role can generate credentials for. If set to '*' all namespaces are allowed. AllowedKubernetesNamespaces []*string `json:"allowedKubernetesNamespaces,omitempty" tf:"allowed_kubernetes_namespaces,omitempty"` // The path of the Kubernetes Secrets Engine backend mount to create @@ -177,18 +161,9 @@ type SecretBackendRoleObservation struct { type SecretBackendRoleParameters struct { - // A label selector for Kubernetes namespaces - // in which credentials can be generated. Accepts either a JSON or YAML object. The value should be - // of type LabelSelector. - // If set with allowed_kubernetes_namespace, the conditions are ORed. - // A label selector for Kubernetes namespaces in which credentials can begenerated. Accepts either a JSON or YAML object. The value should be of typeLabelSelector. If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed. - // +kubebuilder:validation:Optional - AllowedKubernetesNamespaceSelector *string `json:"allowedKubernetesNamespaceSelector,omitempty" tf:"allowed_kubernetes_namespace_selector,omitempty"` - // The list of Kubernetes namespaces this role - // can generate credentials for. If set to * all namespaces are allowed. If set with - // allowed_kubernetes_namespace_selector, the conditions are ORed. - // The list of Kubernetes namespaces this role can generate credentials for. If set to '*' all namespaces are allowed. If set with`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed. + // can generate credentials for. If set to * all namespaces are allowed. + // The list of Kubernetes namespaces this role can generate credentials for. If set to '*' all namespaces are allowed. // +kubebuilder:validation:Optional AllowedKubernetesNamespaces []*string `json:"allowedKubernetesNamespaces,omitempty" tf:"allowed_kubernetes_namespaces,omitempty"` @@ -305,6 +280,7 @@ type SecretBackendRoleStatus struct { type SecretBackendRole struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` + // +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.allowedKubernetesNamespaces) || has(self.initProvider.allowedKubernetesNamespaces)",message="allowedKubernetesNamespaces is a required parameter" // +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.backend) || has(self.initProvider.backend)",message="backend is a required parameter" // +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.name) || has(self.initProvider.name)",message="name is a required parameter" Spec SecretBackendRoleSpec `json:"spec"` diff --git a/apis/mongodbatlas/v1alpha1/zz_secretrole_types.go b/apis/mongodbatlas/v1alpha1/zz_secretrole_types.go index ae1b635d..959859b4 100755 --- a/apis/mongodbatlas/v1alpha1/zz_secretrole_types.go +++ b/apis/mongodbatlas/v1alpha1/zz_secretrole_types.go @@ -52,11 +52,11 @@ type SecretRoleInitParameters struct { // ID for the project to which the target API Key belongs ProjectID *string `json:"projectId,omitempty" tf:"project_id,omitempty"` - // Roles assigned when an org API key is assigned to a project API key. Possible values are GROUP_CLUSTER_MANAGER, GROUP_DATA_ACCESS_ADMIN, GROUP_DATA_ACCESS_READ_ONLY, GROUP_DATA_ACCESS_READ_WRITE, GROUP_OWNER and GROUP_READ_ONLY. + // Roles assigned when an org API key is assigned to a project API key. // Roles assigned when an org API key is assigned to a project API key ProjectRoles []*string `json:"projectRoles,omitempty" tf:"project_roles,omitempty"` - // List of roles that the API Key needs to have. Possible values are ORG_OWNER, ORG_MEMBER, ORG_GROUP_CREATOR, ORG_BILLING_ADMIN and ORG_READ_ONLY. + // List of roles that the API Key needs to have. // List of roles that the API Key needs to have Roles []*string `json:"roles,omitempty" tf:"roles,omitempty"` @@ -106,11 +106,11 @@ type SecretRoleObservation struct { // ID for the project to which the target API Key belongs ProjectID *string `json:"projectId,omitempty" tf:"project_id,omitempty"` - // Roles assigned when an org API key is assigned to a project API key. Possible values are GROUP_CLUSTER_MANAGER, GROUP_DATA_ACCESS_ADMIN, GROUP_DATA_ACCESS_READ_ONLY, GROUP_DATA_ACCESS_READ_WRITE, GROUP_OWNER and GROUP_READ_ONLY. + // Roles assigned when an org API key is assigned to a project API key. // Roles assigned when an org API key is assigned to a project API key ProjectRoles []*string `json:"projectRoles,omitempty" tf:"project_roles,omitempty"` - // List of roles that the API Key needs to have. Possible values are ORG_OWNER, ORG_MEMBER, ORG_GROUP_CREATOR, ORG_BILLING_ADMIN and ORG_READ_ONLY. + // List of roles that the API Key needs to have. // List of roles that the API Key needs to have Roles []*string `json:"roles,omitempty" tf:"roles,omitempty"` @@ -166,12 +166,12 @@ type SecretRoleParameters struct { // +kubebuilder:validation:Optional ProjectID *string `json:"projectId,omitempty" tf:"project_id,omitempty"` - // Roles assigned when an org API key is assigned to a project API key. Possible values are GROUP_CLUSTER_MANAGER, GROUP_DATA_ACCESS_ADMIN, GROUP_DATA_ACCESS_READ_ONLY, GROUP_DATA_ACCESS_READ_WRITE, GROUP_OWNER and GROUP_READ_ONLY. + // Roles assigned when an org API key is assigned to a project API key. // Roles assigned when an org API key is assigned to a project API key // +kubebuilder:validation:Optional ProjectRoles []*string `json:"projectRoles,omitempty" tf:"project_roles,omitempty"` - // List of roles that the API Key needs to have. Possible values are ORG_OWNER, ORG_MEMBER, ORG_GROUP_CREATOR, ORG_BILLING_ADMIN and ORG_READ_ONLY. + // List of roles that the API Key needs to have. // List of roles that the API Key needs to have // +kubebuilder:validation:Optional Roles []*string `json:"roles,omitempty" tf:"roles,omitempty"` diff --git a/apis/pki/v1alpha1/zz_generated.deepcopy.go b/apis/pki/v1alpha1/zz_generated.deepcopy.go index 0c62587a..a2e2b165 100644 --- a/apis/pki/v1alpha1/zz_generated.deepcopy.go +++ b/apis/pki/v1alpha1/zz_generated.deepcopy.go @@ -848,11 +848,6 @@ func (in *SecretBackendConfigUrlsInitParameters) DeepCopyInto(out *SecretBackend } } } - if in.EnableTemplating != nil { - in, out := &in.EnableTemplating, &out.EnableTemplating - *out = new(bool) - **out = **in - } if in.IssuingCertificates != nil { in, out := &in.IssuingCertificates, &out.IssuingCertificates *out = make([]*string, len(*in)) @@ -943,11 +938,6 @@ func (in *SecretBackendConfigUrlsObservation) DeepCopyInto(out *SecretBackendCon } } } - if in.EnableTemplating != nil { - in, out := &in.EnableTemplating, &out.EnableTemplating - *out = new(bool) - **out = **in - } if in.ID != nil { in, out := &in.ID, &out.ID *out = new(string) @@ -1011,11 +1001,6 @@ func (in *SecretBackendConfigUrlsParameters) DeepCopyInto(out *SecretBackendConf } } } - if in.EnableTemplating != nil { - in, out := &in.EnableTemplating, &out.EnableTemplating - *out = new(bool) - **out = **in - } if in.IssuingCertificates != nil { in, out := &in.IssuingCertificates, &out.IssuingCertificates *out = make([]*string, len(*in)) @@ -3790,6 +3775,11 @@ func (in *SecretBackendRootCertObservation) DeepCopyInto(out *SecretBackendRootC *out = new(string) **out = **in } + if in.Serial != nil { + in, out := &in.Serial, &out.Serial + *out = new(string) + **out = **in + } if in.SerialNumber != nil { in, out := &in.SerialNumber, &out.SerialNumber *out = new(string) @@ -4425,6 +4415,11 @@ func (in *SecretBackendRootSignIntermediateObservation) DeepCopyInto(out *Secret *out = new(bool) **out = **in } + if in.Serial != nil { + in, out := &in.Serial, &out.Serial + *out = new(string) + **out = **in + } if in.SerialNumber != nil { in, out := &in.SerialNumber, &out.SerialNumber *out = new(string) @@ -4958,6 +4953,11 @@ func (in *SecretBackendSignObservation) DeepCopyInto(out *SecretBackendSignObser *out = new(bool) **out = **in } + if in.Serial != nil { + in, out := &in.Serial, &out.Serial + *out = new(string) + **out = **in + } if in.SerialNumber != nil { in, out := &in.SerialNumber, &out.SerialNumber *out = new(string) diff --git a/apis/pki/v1alpha1/zz_secretbackendconfigurls_types.go b/apis/pki/v1alpha1/zz_secretbackendconfigurls_types.go index 2bfa0e75..352b4328 100755 --- a/apis/pki/v1alpha1/zz_secretbackendconfigurls_types.go +++ b/apis/pki/v1alpha1/zz_secretbackendconfigurls_types.go @@ -23,10 +23,6 @@ type SecretBackendConfigUrlsInitParameters struct { // Specifies the URL values for the CRL Distribution Points field. CrlDistributionPoints []*string `json:"crlDistributionPoints,omitempty" tf:"crl_distribution_points,omitempty"` - // Specifies that templating of AIA fields is allowed. - // Specifies that templating of AIA fields is allowed. - EnableTemplating *bool `json:"enableTemplating,omitempty" tf:"enable_templating,omitempty"` - // Specifies the URL values for the Issuing Certificate field. // Specifies the URL values for the Issuing Certificate field. IssuingCertificates []*string `json:"issuingCertificates,omitempty" tf:"issuing_certificates,omitempty"` @@ -53,10 +49,6 @@ type SecretBackendConfigUrlsObservation struct { // Specifies the URL values for the CRL Distribution Points field. CrlDistributionPoints []*string `json:"crlDistributionPoints,omitempty" tf:"crl_distribution_points,omitempty"` - // Specifies that templating of AIA fields is allowed. - // Specifies that templating of AIA fields is allowed. - EnableTemplating *bool `json:"enableTemplating,omitempty" tf:"enable_templating,omitempty"` - ID *string `json:"id,omitempty" tf:"id,omitempty"` // Specifies the URL values for the Issuing Certificate field. @@ -87,11 +79,6 @@ type SecretBackendConfigUrlsParameters struct { // +kubebuilder:validation:Optional CrlDistributionPoints []*string `json:"crlDistributionPoints,omitempty" tf:"crl_distribution_points,omitempty"` - // Specifies that templating of AIA fields is allowed. - // Specifies that templating of AIA fields is allowed. - // +kubebuilder:validation:Optional - EnableTemplating *bool `json:"enableTemplating,omitempty" tf:"enable_templating,omitempty"` - // Specifies the URL values for the Issuing Certificate field. // Specifies the URL values for the Issuing Certificate field. // +kubebuilder:validation:Optional diff --git a/apis/pki/v1alpha1/zz_secretbackendrootcert_types.go b/apis/pki/v1alpha1/zz_secretbackendrootcert_types.go index 91c77865..41447e4e 100755 --- a/apis/pki/v1alpha1/zz_secretbackendrootcert_types.go +++ b/apis/pki/v1alpha1/zz_secretbackendrootcert_types.go @@ -261,6 +261,10 @@ type SecretBackendRootCertObservation struct { // The province. Province *string `json:"province,omitempty" tf:"province,omitempty"` + // Deprecated, use serial_number instead. + // The serial number. + Serial *string `json:"serial,omitempty" tf:"serial,omitempty"` + // The certificate's serial number, hex formatted. // The certificate's serial number, hex formatted. SerialNumber *string `json:"serialNumber,omitempty" tf:"serial_number,omitempty"` diff --git a/apis/pki/v1alpha1/zz_secretbackendrootsignintermediate_types.go b/apis/pki/v1alpha1/zz_secretbackendrootsignintermediate_types.go index f5d5d0e0..ac51d0d9 100755 --- a/apis/pki/v1alpha1/zz_secretbackendrootsignintermediate_types.go +++ b/apis/pki/v1alpha1/zz_secretbackendrootsignintermediate_types.go @@ -158,6 +158,9 @@ type SecretBackendRootSignIntermediateObservation struct { // Revoke the certificate upon resource destruction. Revoke *bool `json:"revoke,omitempty" tf:"revoke,omitempty"` + // The serial number. + Serial *string `json:"serial,omitempty" tf:"serial,omitempty"` + // The certificate's serial number, hex formatted. SerialNumber *string `json:"serialNumber,omitempty" tf:"serial_number,omitempty"` diff --git a/apis/pki/v1alpha1/zz_secretbackendsign_types.go b/apis/pki/v1alpha1/zz_secretbackendsign_types.go index 20f90d2e..23e388b0 100755 --- a/apis/pki/v1alpha1/zz_secretbackendsign_types.go +++ b/apis/pki/v1alpha1/zz_secretbackendsign_types.go @@ -164,6 +164,10 @@ type SecretBackendSignObservation struct { // Initially false, and then set to true during refresh once the expiration is less than min_seconds_remaining in the future. RenewPending *bool `json:"renewPending,omitempty" tf:"renew_pending,omitempty"` + // Use serial_number instead. + // The serial number. + Serial *string `json:"serial,omitempty" tf:"serial,omitempty"` + // The certificate's serial number, hex formatted. // The certificate's serial number, hex formatted. SerialNumber *string `json:"serialNumber,omitempty" tf:"serial_number,omitempty"` diff --git a/apis/ssh/v1alpha1/zz_generated.deepcopy.go b/apis/ssh/v1alpha1/zz_generated.deepcopy.go index c5c341a2..da88a3e9 100644 --- a/apis/ssh/v1alpha1/zz_generated.deepcopy.go +++ b/apis/ssh/v1alpha1/zz_generated.deepcopy.go @@ -403,6 +403,21 @@ func (in *SecretBackendRoleInitParameters) DeepCopyInto(out *SecretBackendRoleIn (*in)[i].DeepCopyInto(&(*out)[i]) } } + if in.AllowedUserKeyLengths != nil { + in, out := &in.AllowedUserKeyLengths, &out.AllowedUserKeyLengths + *out = make(map[string]*float64, len(*in)) + for key, val := range *in { + var outVal *float64 + if val == nil { + (*out)[key] = nil + } else { + in, out := &val, &outVal + *out = new(float64) + **out = **in + } + (*out)[key] = outVal + } + } if in.AllowedUsers != nil { in, out := &in.AllowedUsers, &out.AllowedUsers *out = new(string) @@ -602,6 +617,21 @@ func (in *SecretBackendRoleObservation) DeepCopyInto(out *SecretBackendRoleObser (*in)[i].DeepCopyInto(&(*out)[i]) } } + if in.AllowedUserKeyLengths != nil { + in, out := &in.AllowedUserKeyLengths, &out.AllowedUserKeyLengths + *out = make(map[string]*float64, len(*in)) + for key, val := range *in { + var outVal *float64 + if val == nil { + (*out)[key] = nil + } else { + in, out := &val, &outVal + *out = new(float64) + **out = **in + } + (*out)[key] = outVal + } + } if in.AllowedUsers != nil { in, out := &in.AllowedUsers, &out.AllowedUsers *out = new(string) @@ -774,6 +804,21 @@ func (in *SecretBackendRoleParameters) DeepCopyInto(out *SecretBackendRoleParame (*in)[i].DeepCopyInto(&(*out)[i]) } } + if in.AllowedUserKeyLengths != nil { + in, out := &in.AllowedUserKeyLengths, &out.AllowedUserKeyLengths + *out = make(map[string]*float64, len(*in)) + for key, val := range *in { + var outVal *float64 + if val == nil { + (*out)[key] = nil + } else { + in, out := &val, &outVal + *out = new(float64) + **out = **in + } + (*out)[key] = outVal + } + } if in.AllowedUsers != nil { in, out := &in.AllowedUsers, &out.AllowedUsers *out = new(string) diff --git a/apis/ssh/v1alpha1/zz_secretbackendrole_types.go b/apis/ssh/v1alpha1/zz_secretbackendrole_types.go index 2913e89a..3245b47e 100755 --- a/apis/ssh/v1alpha1/zz_secretbackendrole_types.go +++ b/apis/ssh/v1alpha1/zz_secretbackendrole_types.go @@ -108,6 +108,11 @@ type SecretBackendRoleInitParameters struct { // Set of allowed public key types and their relevant configuration AllowedUserKeyConfig []AllowedUserKeyConfigInitParameters `json:"allowedUserKeyConfig,omitempty" tf:"allowed_user_key_config,omitempty"` + // Specifies a map of ssh key types and their expected sizes which + // are allowed to be signed by the CA type. + // Deprecated: use allowed_user_key_config instead + AllowedUserKeyLengths map[string]*float64 `json:"allowedUserKeyLengths,omitempty" tf:"allowed_user_key_lengths,omitempty"` + // Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed. AllowedUsers *string `json:"allowedUsers,omitempty" tf:"allowed_users,omitempty"` @@ -200,6 +205,11 @@ type SecretBackendRoleObservation struct { // Set of allowed public key types and their relevant configuration AllowedUserKeyConfig []AllowedUserKeyConfigObservation `json:"allowedUserKeyConfig,omitempty" tf:"allowed_user_key_config,omitempty"` + // Specifies a map of ssh key types and their expected sizes which + // are allowed to be signed by the CA type. + // Deprecated: use allowed_user_key_config instead + AllowedUserKeyLengths map[string]*float64 `json:"allowedUserKeyLengths,omitempty" tf:"allowed_user_key_lengths,omitempty"` + // Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed. AllowedUsers *string `json:"allowedUsers,omitempty" tf:"allowed_users,omitempty"` @@ -305,6 +315,12 @@ type SecretBackendRoleParameters struct { // +kubebuilder:validation:Optional AllowedUserKeyConfig []AllowedUserKeyConfigParameters `json:"allowedUserKeyConfig,omitempty" tf:"allowed_user_key_config,omitempty"` + // Specifies a map of ssh key types and their expected sizes which + // are allowed to be signed by the CA type. + // Deprecated: use allowed_user_key_config instead + // +kubebuilder:validation:Optional + AllowedUserKeyLengths map[string]*float64 `json:"allowedUserKeyLengths,omitempty" tf:"allowed_user_key_lengths,omitempty"` + // Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed. // +kubebuilder:validation:Optional AllowedUsers *string `json:"allowedUsers,omitempty" tf:"allowed_users,omitempty"` diff --git a/apis/transit/v1alpha1/zz_generated.deepcopy.go b/apis/transit/v1alpha1/zz_generated.deepcopy.go index 96e8de02..b3925ed3 100644 --- a/apis/transit/v1alpha1/zz_generated.deepcopy.go +++ b/apis/transit/v1alpha1/zz_generated.deepcopy.go @@ -48,6 +48,11 @@ func (in *SecretBackendKeyInitParameters) DeepCopyInto(out *SecretBackendKeyInit *out = new(bool) **out = **in } + if in.AutoRotateInterval != nil { + in, out := &in.AutoRotateInterval, &out.AutoRotateInterval + *out = new(float64) + **out = **in + } if in.AutoRotatePeriod != nil { in, out := &in.AutoRotatePeriod, &out.AutoRotatePeriod *out = new(float64) @@ -160,6 +165,11 @@ func (in *SecretBackendKeyObservation) DeepCopyInto(out *SecretBackendKeyObserva *out = new(bool) **out = **in } + if in.AutoRotateInterval != nil { + in, out := &in.AutoRotateInterval, &out.AutoRotateInterval + *out = new(float64) + **out = **in + } if in.AutoRotatePeriod != nil { in, out := &in.AutoRotatePeriod, &out.AutoRotatePeriod *out = new(float64) @@ -296,6 +306,11 @@ func (in *SecretBackendKeyParameters) DeepCopyInto(out *SecretBackendKeyParamete *out = new(bool) **out = **in } + if in.AutoRotateInterval != nil { + in, out := &in.AutoRotateInterval, &out.AutoRotateInterval + *out = new(float64) + **out = **in + } if in.AutoRotatePeriod != nil { in, out := &in.AutoRotatePeriod, &out.AutoRotatePeriod *out = new(float64) diff --git a/apis/transit/v1alpha1/zz_secretbackendkey_types.go b/apis/transit/v1alpha1/zz_secretbackendkey_types.go index ad1bec1d..d489b35b 100755 --- a/apis/transit/v1alpha1/zz_secretbackendkey_types.go +++ b/apis/transit/v1alpha1/zz_secretbackendkey_types.go @@ -19,6 +19,10 @@ type SecretBackendKeyInitParameters struct { // If set, enables taking backup of named key in the plaintext format. Once set, this cannot be disabled. AllowPlaintextBackup *bool `json:"allowPlaintextBackup,omitempty" tf:"allow_plaintext_backup,omitempty"` + // Replaced by auto_rotate_period. + // Amount of time the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key. + AutoRotateInterval *float64 `json:"autoRotateInterval,omitempty" tf:"auto_rotate_interval,omitempty"` + // Amount of seconds the key should live before being automatically rotated. // A value of 0 disables automatic rotation for the key. // Amount of seconds the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key. @@ -78,6 +82,10 @@ type SecretBackendKeyObservation struct { // If set, enables taking backup of named key in the plaintext format. Once set, this cannot be disabled. AllowPlaintextBackup *bool `json:"allowPlaintextBackup,omitempty" tf:"allow_plaintext_backup,omitempty"` + // Replaced by auto_rotate_period. + // Amount of time the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key. + AutoRotateInterval *float64 `json:"autoRotateInterval,omitempty" tf:"auto_rotate_interval,omitempty"` + // Amount of seconds the key should live before being automatically rotated. // A value of 0 disables automatic rotation for the key. // Amount of seconds the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key. @@ -168,6 +176,11 @@ type SecretBackendKeyParameters struct { // +kubebuilder:validation:Optional AllowPlaintextBackup *bool `json:"allowPlaintextBackup,omitempty" tf:"allow_plaintext_backup,omitempty"` + // Replaced by auto_rotate_period. + // Amount of time the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key. + // +kubebuilder:validation:Optional + AutoRotateInterval *float64 `json:"autoRotateInterval,omitempty" tf:"auto_rotate_interval,omitempty"` + // Amount of seconds the key should live before being automatically rotated. // A value of 0 disables automatic rotation for the key. // Amount of seconds the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key. diff --git a/config/provider-metadata.yaml b/config/provider-metadata.yaml index c7caa367..50f98979 100644 --- a/config/provider-metadata.yaml +++ b/config/provider-metadata.yaml @@ -39,6 +39,7 @@ resources: postal_code: '- (Optional) The postal code' province: '- (Optional) The province' revoke: '- If set to true, the certificate will be revoked on resource destruction.' + serial: '- Use serial_number instead.' serial_number: '- The certificate''s serial number, hex formatted.' street_address: '- (Optional) The street address' ttl: '- (Optional) Time to live' @@ -87,6 +88,7 @@ resources: - (Optional) If set, opts out of mount migration on path updates. See here for more info on Mount Migration discoverdn: '- (Optional) Use anonymous bind to discover the bind Distinguished Name of a user.' + formatter: '- (Optional) Deprecated use password_policy. Text to insert the password into, ex. "customPrefix{{PASSWORD}}customSuffix".' groupattr: |- - (Optional) LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: cn or memberOf, etc. Defaults to cn. @@ -100,6 +102,9 @@ resources: last_rotation_tolerance: |- - (Optional) The number of seconds after a Vault rotation where, if Active Directory shows a later rotation, it should be considered out-of-band + length: |- + - (Optional) Deprecated use password_policy. The desired length of passwords that Vault generates. + Mutually exclusive with local: |- - (Optional) Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration to use when checking the last rotation time. @@ -110,7 +115,7 @@ resources: The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise. - password_policy: '- (Optional) Name of the password policy to use to generate passwords.' + password_policy: on vault-1.11+ request_timeout: |- - (Optional) Timeout, in seconds, for the connection when making requests against the server before returning back an error. @@ -572,7 +577,10 @@ resources: allowed_dns_sans: '- (Optional array: []) Allowed alternative dns names for authenticated client certificates' allowed_email_sans: '- (Optional array: []) Allowed emails for authenticated client certificates' allowed_names: '- (Optional string) DEPRECATED: Please use the individual allowed_X_sans parameters instead. Allowed subject names for authenticated client certificates' - allowed_organizational_units: '- (Optional array: []) Allowed organization units for authenticated client certificates.' + allowed_organization_units: ', please update accordingly' + allowed_organizational_units: |- + - (Optional array: []) Allowed organization units for authenticated client certificates. + In previous provider releases this field was incorrectly named allowed_uri_sans: '- (Optional array: []) Allowed URIs for authenticated client certificates' backend: '- (Optional string: "cert") Path to the mounted Cert auth backend' certificate: '- (Required string) CA certificate used to validate client certificates' @@ -1746,42 +1754,6 @@ resources: – (Optional) Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time. importStatements: [] - vault_config_ui_custom_message: - subCategory: "" - description: Manages a UI custom message in Vault. - name: vault_config_ui_custom_message - title: vault_config_ui_custom_message resource - examples: - - name: maintenance - manifest: |- - { - "authenticated": true, - "end_time": "2024-02-01T05:00:00.000Z", - "message": "${base64encode(\"Vault will be offline for planned maintenance on February 1st, 2024 from 05:00Z to 08:00Z\")}", - "start_time": "2024-01-01T00:00:00.000Z", - "title": "Upcoming maintenance", - "type": "banner" - } - argumentDocs: - authenticated: |- - - (Optional) The value true if the custom message is displayed after logins are completed or false if they are - displayed during the login in the Vault UI. The default value is true. - end_time: '- (Optional) The time when the custom message expires. If this value is not specified, the custom message never expires.' - href: '- (Required) The URL set in the hyperlink''s href attribute.' - link: '- (Optional) A hyperlink to be included with the message. See below for more details.' - message: '- (Required) The base64-encoded content of the custom message.' - namespace: |- - - (Optional) The namespace to provision the resource in. - The value should not contain leading or trailing forward slashes. - The namespace is always relative to the provider's configured namespace. - Available only for Vault Enterprise. - options: '- (Optional) A map of additional options that can be set on the custom message.' - start_time: |- - - (Required) The time when the custom message begins to be active. This value can be set to a future time, but cannot - occur on or after the end_time value. - title: '- (Required) The title of the custom message to create.' - type: '- (Optional) The presentation type of the custom message. Must be one of the following values: banner or modal.' - importStatements: [] vault_consul_secret_backend: subCategory: "" description: Creates a Consul secret backend for Vault. @@ -1891,6 +1863,9 @@ resources: service_identities: |- - (Optional)SEE NOTE Set of Consul service identities to attach to the token. Applicable for Vault 1.11+ with Consul 1.5+. + token_type: |- + - (Optional) Specifies the type of token to create when using this role. Valid values are "client" or "management". + Deprecated: Consul 1.11 and later removed the legacy ACL system which supported this field. ttl: '- (Optional) Specifies the TTL for this role.' importStatements: [] vault_database_secret_backend_connection: @@ -3365,6 +3340,10 @@ resources: exclusive: '- (Optional) Defaults to true.' "false": ', this resource will simply ensure that the member entities specified in the resource are present in the group. When destroying the resource, the resource will ensure that the member entities specified in the resource are removed.' group_id: '- (Required) Group ID to assign member entities to.' + group_name: |- + - The name of the group that are assigned the member entities. + Deprecated: The value for group_name may not always be accurate + use data.vault_identity_group.*.group_name, or vault_identity_group.*.group_name instead. member_entity_ids: '- (Required) List of member entities that belong to the group' namespace: |- - (Optional) The namespace to provision the resource in. @@ -3782,10 +3761,6 @@ resources: argumentDocs: access_token_ttl: '- (Optional) The time-to-live for access tokens obtained by the client.' assignments: '- (Optional) A list of assignment resources associated with the client.' - client_id: '- The Client ID returned by Vault.' - client_secret: |- - - The Client Secret Key returned by Vault. - For public OpenID Clients client_secret is set to an empty string "" client_type: |- - (Optional) The client type based on its ability to maintain confidentiality of credentials. The following client types are supported: confidential, public. Defaults to confidential. @@ -4708,15 +4683,9 @@ resources: "service_account_jwt": "${file(\"/path/to/token\")}" } argumentDocs: - allowed_kubernetes_namespace_selector: |- - - (Optional) A label selector for Kubernetes namespaces - in which credentials can be generated. Accepts either a JSON or YAML object. The value should be - of type LabelSelector. - If set with allowed_kubernetes_namespace, the conditions are ORed. allowed_kubernetes_namespaces: |- - - (Optional) The list of Kubernetes namespaces this role - can generate credentials for. If set to * all namespaces are allowed. If set with - allowed_kubernetes_namespace_selector, the conditions are ORed. + - (Required) The list of Kubernetes namespaces this role + can generate credentials for. If set to * all namespaces are allowed. backend: |- - (Required) The path of the Kubernetes Secrets Engine backend mount to create the role in. @@ -4944,6 +4913,9 @@ resources: insecure_tls: |- - (Optional) Skip LDAP server SSL Certificate verification. This is not recommended for production. Defaults to false. + length: |- + - (Optional) Deprecated use password_policy. The desired length of passwords that Vault generates. + Mutually exclusive with local: |- - (Optional) Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration to use when checking the last rotation time. @@ -4953,7 +4925,7 @@ resources: The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise. - password_policy: '- (Optional) Name of the password policy to use to generate passwords.' + password_policy: on vault-1.11+ path: |- - (Optional) The unique path this backend should be mounted at. Must not begin or end with a /. Defaults to ldap. @@ -4961,9 +4933,6 @@ resources: - (Optional) Timeout, in seconds, for the connection when making requests against the server before returning back an error. schema: '- (Optional) The LDAP schema to use when storing entry passwords. Valid schemas include openldap, ad, and racf. Default is openldap.' - skip_static_role_import_rotation: |- - - (Optional) If set to true, static roles will not be rotated during import. - Defaults to false. Requires Vault 1.16 or above. starttls: '- (Optional) Issue a StartTLS command after establishing unencrypted connection.' upndomain: '- (Optional) Enables userPrincipalDomain login with [username]@UPNDomain.' url: |- @@ -5134,9 +5103,6 @@ resources: Available only for Vault Enterprise. role_name: '- (Required) Name of the role.' rotation_period: '- (Required) How often Vault should rotate the password of the user entry.' - skip_import_rotation: |- - - (Optional) Causes vault to skip the initial secret rotation on import. Not applicable to updates. - Requires Vault 1.16 or above. username: '- (Required) The username of the existing LDAP entry to manage password rotation for.' importStatements: [] vault_managed_keys: @@ -5419,12 +5385,10 @@ resources: - name: config manifest: |- { - "mount": "${vault_mount.mongo.path}", + "mount": "vault_mount.mongo.path", "private_key": "privateKey", "public_key": "publicKey" } - references: - mount: vault_mount.mongo.path dependencies: vault_mount.mongo: |- { @@ -5458,12 +5422,8 @@ resources: "name": "tf-test-role", "organization_id": "7cf5a45a9ccf6400e60981b7", "project_id": "5cf5a45a9ccf6400e60981b6", - "project_roles": [ - "GROUP_READ_ONLY" - ], - "roles": [ - "ORG_READ_ONLY" - ], + "project_roles": "GROUP_READ_ONLY", + "roles": "ORG_READ_ONLY", "ttl": "60" } references: @@ -5471,7 +5431,7 @@ resources: dependencies: vault_mongodbatlas_secret_backend.config: |- { - "mount": "${vault_mount.mongo.path}", + "mount": "vault_mount.mongo.path", "private_key": "privateKey", "public_key": "publicKey" } @@ -5498,8 +5458,8 @@ resources: project_id: |- - (Optional) Unique identifier for the project to which the target API Key belongs. Required if organization_id is not set. - project_roles: '- (Optional) Roles assigned when an org API key is assigned to a project API key. Possible values are GROUP_CLUSTER_MANAGER, GROUP_DATA_ACCESS_ADMIN, GROUP_DATA_ACCESS_READ_ONLY, GROUP_DATA_ACCESS_READ_WRITE, GROUP_OWNER and GROUP_READ_ONLY.' - roles: '- (Required) List of roles that the API Key needs to have. Possible values are ORG_OWNER, ORG_MEMBER, ORG_GROUP_CREATOR, ORG_BILLING_ADMIN and ORG_READ_ONLY.' + project_roles: '- (Optional) Roles assigned when an org API key is assigned to a project API key.' + roles: '- (Required) List of roles that the API Key needs to have.' ttl: '- (Optional) Duration in seconds after which the issued credential should expire.' importStatements: [] vault_mount: @@ -5847,40 +5807,6 @@ resources: Available only for Vault Enterprise. pem_bundle: '- (Required) The key and certificate PEM bundle' importStatements: [] - vault_pki_secret_backend_config_cluster: - subCategory: "" - description: Sets the cluster configuration on an PKI Secret Backend for Vault. - name: vault_pki_secret_backend_config_cluster - title: vault_pki_secret_backend_config_cluster resource - examples: - - name: example - manifest: |- - { - "aia_path": "http://127.0.0.1:8200/v1/pki-root", - "backend": "${vault_mount.root.path}", - "path": "http://127.0.0.1:8200/v1/pki-root" - } - references: - backend: vault_mount.root.path - dependencies: - vault_mount.root: |- - { - "default_lease_ttl_seconds": 8640000, - "description": "root PKI", - "max_lease_ttl_seconds": 8640000, - "path": "pki-root", - "type": "pki" - } - argumentDocs: - aia_path: '- (Required) Specifies the path to this performance replication cluster''s AIA distribution point.' - backend: '- (Required) The path the PKI secret backend is mounted at, with no leading or trailing /s.' - namespace: |- - - (Optional) The namespace to provision the resource in. - The value should not contain leading or trailing forward slashes. - The namespace is always relative to the provider's configured namespace. - Available only for Vault Enterprise. - path: '- (Required) Specifies the path to this performance replication cluster''s API mount path.' - importStatements: [] vault_pki_secret_backend_config_issuers: subCategory: "" description: Allows setting the value of the default issuer. @@ -5963,7 +5889,6 @@ resources: argumentDocs: backend: '- (Required) The path the PKI secret backend is mounted at, with no leading or trailing /s.' crl_distribution_points: '- (Optional) Specifies the URL values for the CRL Distribution Points field.' - enable_templating: '- (Optional) Specifies that templating of AIA fields is allowed.' issuing_certificates: '- (Optional) Specifies the URL values for the Issuing Certificate field.' namespace: |- - (Optional) The namespace to provision the resource in. @@ -6480,6 +6405,7 @@ resources: postal_code: '- (Optional) The postal code' private_key_format: '- (Optional) The private key format' province: '- (Optional) The province' + serial: '- Deprecated, use serial_number instead.' serial_number: '- The certificate''s serial number, hex formatted.' street_address: '- (Optional) The street address' ttl: '- (Optional) Time to live' @@ -6535,6 +6461,7 @@ resources: Available only for Vault Enterprise. other_sans: '- (Optional) List of other SANs' renew_pending: '- true if the current time (during refresh) is after the start of the early renewal window declared by min_seconds_remaining, and false otherwise; if auto_renew is set to true then the provider will plan to replace the certificate once renewal is pending.' + serial: '- Use serial_number instead.' serial_number: '- The certificate''s serial number, hex formatted.' ttl: '- (Optional) Time to live' uri_sans: '- (Optional) List of alternative URIs' @@ -7102,16 +7029,9 @@ resources: The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. secret_name: '- (Required) Specifies the name of the secret to synchronize.' - subkeys: '- A list of subkeys for the associated secret.' - sync_status: |- - - A map of sync statuses for each subkey of the associated secret - (for ex. {kv_624bea/aws-token/dev: "SYNCED", kv_624bea/aws-token/prod: "SYNCED"}). + sync_status: '- Specifies the status of the association (for eg. SYNCED).' type: '- (Required) Specifies the destination type.' - updated_at: |- - - A map of duration strings specifying when each subkey of the associated - secret was last updated. - (for ex. - {kv_624bea/aws-token/dev: "2024-03-21T12:42:02.558533-07:00", kv_624bea/aws-token/prod: "2024-03-21T12:42:02.558533-07:00"}). + updated_at: '- Duration string specifying when the secret was last updated.' importStatements: [] vault_secrets_sync_aws_destination: subCategory: "" @@ -7126,10 +7046,8 @@ resources: "custom_tags": { "foo": "bar" }, - "external_id": "external-id", "name": "aws-dest", "region": "us-east-1", - "role_arn": "role-arn", "secret_access_key": "${var.secret_access_key}", "secret_name_template": "vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}" } @@ -7142,15 +7060,6 @@ resources: Can be omitted and directly provided to Vault using the AWS_ACCESS_KEY_ID environment variable. custom_tags: '- (Optional) Custom tags to set on the secret managed at the destination.' - external_id: |- - - (Optional) Optional extra protection that must match the trust policy granting access to the - AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users. - The field is mutable with no special condition, but users must be careful that the new value fits with the trust - relationship condition they set on AWS otherwise sync operations will start to fail due to client-side access - denied errors. Ignored if the role_arn field is empty. - granularity: |- - - (Optional) Determines what level of information is synced as a distinct resource - at the destination. Supports secret-path and secret-key. name: '- (Required) Unique name of the AWS destination.' namespace: |- - (Optional) The namespace to provision the resource in. @@ -7160,12 +7069,6 @@ resources: - (Optional) Region where to manage the secrets manager entries. Can be omitted and directly provided to Vault using the AWS_REGION environment variable. - role_arn: |- - - (Optional) Specifies a role to assume when connecting to AWS. When assuming a role, - Vault uses temporary STS credentials to authenticate. An initial session with the proper trust relationship must - exist for Vault to be able to assume this role. The role can be in a different account. - The value is mutable as long as the new role targets the same AWS account ID. If not, the BE will return an error. - It is possible to provide both an access key pair and a role to assume. secret_access_key: |- - (Optional) Secret access key to authenticate against the AWS secrets manager. Can be omitted and directly provided to Vault using the AWS_SECRET_ACCESS_KEY environment @@ -7210,9 +7113,6 @@ resources: variable. cloud: '- (Optional) Specifies a cloud for the client. The default is Azure Public Cloud.' custom_tags: '- (Optional) Custom tags to set on the secret managed at the destination.' - granularity: |- - - (Optional) Determines what level of information is synced as a distinct resource - at the destination. Supports secret-path and secret-key. key_vault_uri: |- - (Optional) URI of an existing Azure Key Vault instance. Can be omitted and directly provided to Vault using the KEY_VAULT_URI environment @@ -7265,7 +7165,6 @@ resources: "foo": "bar" }, "name": "gcp-dest", - "project_id": "gcp-project-id", "secret_name_template": "vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}" } argumentDocs: @@ -7274,19 +7173,11 @@ resources: Can be omitted and directly provided to Vault using the GOOGLE_APPLICATION_CREDENTIALS environment variable. custom_tags: '- (Optional) Custom tags to set on the secret managed at the destination.' - granularity: |- - - (Optional) Determines what level of information is synced as a distinct resource - at the destination. Supports secret-path and secret-key. name: '- (Required) Unique name of the GCP destination.' namespace: |- - (Optional) The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. - project_id: |- - - (Optional) The target project to manage secrets in. If set, - overrides the project ID derived from the service account JSON credentials or application - default credentials. The service account must be authorized - to perform Secret Manager actions in the target project. secret_name_template: |- - (Optional) Template describing how to generate external secret names. Supports a subset of the Go Template syntax. @@ -7315,16 +7206,6 @@ resources: - (Optional) Fine-grained or personal access token. Can be omitted and directly provided to Vault using the GITHUB_ACCESS_TOKEN environment variable. - app_name: |- - - (Optional) The user-defined name of the GitHub App configuration. This is a reference to the name used - on the new endpoint when configuring the GitHub app on the Vault Server. Can be modified. - Takes precedence over the access_token field. - granularity: |- - - (Optional) Determines what level of information is synced as a distinct resource - at the destination. Supports secret-path and secret-key. - installation_id: |- - -(Optional) The ID of the installation generated by GitHub when the app referenced by the app_name - was installed in the user’s GitHub account. Can be modified. Necessary if the app_name field is also provided. name: '- (Required) Unique name of the GitHub destination.' namespace: |- - (Optional) The namespace to provision the resource in. @@ -7343,30 +7224,6 @@ resources: Supports a subset of the Go Template syntax. type: '- The type of the secrets destination (gh).' importStatements: [] - vault_secrets_sync_github_apps: - subCategory: "" - description: Creates a GitHub App to synchronize secrets in Vault - name: vault_secrets_sync_github_apps - title: vault_secrets_sync_github_apps resource - examples: - - name: github-apps - manifest: |- - { - "app_id": "${var.app_id}", - "name": "gh-apps", - "private_key": "${file(var.privatekey_file)}" - } - references: - app_id: var.app_id - argumentDocs: - app_id: '- (Required) The GitHub application ID.' - name: '- (Required) The user-defined name of the GitHub App configuration.' - namespace: |- - - (Optional) The namespace to provision the resource in. - The value should not contain leading or trailing forward slashes. - The namespace is always relative to the provider's configured namespace. - private_key: '- (Required) The content of a PEM formatted private key generated on GitHub for the app.' - importStatements: [] vault_secrets_sync_vercel_destination: subCategory: "" description: Creates a GitHub destination to synchronize secrets in Vault @@ -7396,9 +7253,6 @@ resources: deployment_environments: |- - (Required) Deployment environments where the environment variables are available. Accepts development, preview and production. - granularity: |- - - (Optional) Determines what level of information is synced as a distinct resource - at the destination. Supports secret-path and secret-key. name: '- (Required) Unique name of the GitHub destination.' namespace: |- - (Optional) The namespace to provision the resource in. @@ -7495,6 +7349,10 @@ resources: - (Optional) Set of configuration blocks to define allowed user key configuration, like key type and their lengths. Can be specified multiple times. See + allowed_user_key_lengths: |- + - (Optional) Specifies a map of ssh key types and their expected sizes which + are allowed to be signed by the CA type. + Deprecated: use allowed_user_key_config instead allowed_users: '- (Optional) Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed.' allowed_users_template: '- (Optional) Specifies if allowed_users can be declared using identity template policies. Non-templated users are also permitted.' backend: '- (Required) The path where the SSH secret backend is mounted.' @@ -7954,6 +7812,7 @@ resources: argumentDocs: aes128-gcm96: ', aes256-gcm96 and chacha20-poly1305, each key version will be a map of a single value id which is just a hash of the key''s metadata.' allow_plaintext_backup: '- (Optional) Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.' + auto_rotate_interval: '- Replaced by auto_rotate_period.' auto_rotate_period: |- - (Optional) Amount of seconds the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key. diff --git a/config/schema.json b/config/schema.json index 9539ae16..23b07562 100644 --- a/config/schema.json +++ b/config/schema.json @@ -1 +1 @@ -{"format_version":"1.0","provider_schemas":{"registry.terraform.io/hashicorp/vault":{"provider":{"version":0,"block":{"attributes":{"add_address_to_env":{"type":"string","description":"If true, adds the value of the `address` argument to the Terraform process environment.","description_kind":"plain","optional":true},"address":{"type":"string","description":"URL of the root of the target Vault server.","description_kind":"plain","required":true},"ca_cert_dir":{"type":"string","description":"Path to directory containing CA certificate files to validate the server's certificate.","description_kind":"plain","optional":true},"ca_cert_file":{"type":"string","description":"Path to a CA certificate file to validate the server's certificate.","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum TTL for secret leases requested by this provider.","description_kind":"plain","optional":true},"max_retries":{"type":"number","description":"Maximum number of retries when a 5xx error code is encountered.","description_kind":"plain","optional":true},"max_retries_ccc":{"type":"number","description":"Maximum number of retries for Client Controlled Consistency related operations","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The namespace to use. Available only for Vault Enterprise.","description_kind":"plain","optional":true},"set_namespace_from_token":{"type":"bool","description":"In the case where the Vault token is for a specific namespace and the provider namespace is not configured, use the token namespace as the root namespace for all resources.","description_kind":"plain","optional":true},"skip_child_token":{"type":"bool","description":"Set this to true to prevent the creation of ephemeral child token used by this provider.","description_kind":"plain","optional":true},"skip_get_vault_version":{"type":"bool","description":"Skip the dynamic fetching of the Vault server version.","description_kind":"plain","optional":true},"skip_tls_verify":{"type":"bool","description":"Set this to true only if the target Vault server is an insecure development instance.","description_kind":"plain","optional":true},"tls_server_name":{"type":"string","description":"Name to use as the SNI host when connecting via TLS.","description_kind":"plain","optional":true},"token":{"type":"string","description":"Token to use to authenticate to Vault.","description_kind":"plain","optional":true},"token_name":{"type":"string","description":"Token name to use for creating the Vault child token.","description_kind":"plain","optional":true},"vault_version_override":{"type":"string","description":"Override the Vault server version, which is normally determined dynamically from the target Vault server","description_kind":"plain","optional":true}},"block_types":{"auth_login":{"nesting_mode":"list","block":{"attributes":{"method":{"type":"string","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"parameters":{"type":["map","string"],"description_kind":"plain","optional":true,"sensitive":true},"path":{"type":"string","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault with an existing auth method using auth/\u003cmount\u003e/login","description_kind":"plain"},"max_items":1},"auth_login_aws":{"nesting_mode":"list","block":{"attributes":{"aws_access_key_id":{"type":"string","description":"The AWS access key ID.","description_kind":"plain","optional":true},"aws_iam_endpoint":{"type":"string","description":"The IAM endpoint URL.","description_kind":"plain","optional":true},"aws_profile":{"type":"string","description":"The name of the AWS profile.","description_kind":"plain","optional":true},"aws_region":{"type":"string","description":"The AWS region.","description_kind":"plain","optional":true},"aws_role_arn":{"type":"string","description":"The ARN of the AWS Role to assume.Used during STS AssumeRole","description_kind":"plain","optional":true},"aws_role_session_name":{"type":"string","description":"Specifies the name to attach to the AWS role session. Used during STS AssumeRole","description_kind":"plain","optional":true},"aws_secret_access_key":{"type":"string","description":"The AWS secret access key.","description_kind":"plain","optional":true},"aws_session_token":{"type":"string","description":"The AWS session token.","description_kind":"plain","optional":true},"aws_shared_credentials_file":{"type":"string","description":"Path to the AWS shared credentials file.","description_kind":"plain","optional":true},"aws_sts_endpoint":{"type":"string","description":"The STS endpoint URL.","description_kind":"plain","optional":true},"aws_web_identity_token_file":{"type":"string","description":"Path to the file containing an OAuth 2.0 access token or OpenID Connect ID token.","description_kind":"plain","optional":true},"header_value":{"type":"string","description":"The Vault header value to include in the STS signing request.","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"role":{"type":"string","description":"The Vault role to use when logging into Vault.","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the AWS method","description_kind":"plain"},"max_items":1},"auth_login_azure":{"nesting_mode":"list","block":{"attributes":{"client_id":{"type":"string","description":"The identity's client ID.","description_kind":"plain","optional":true},"jwt":{"type":"string","description":"A signed JSON Web Token. If not specified on will be created automatically","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"resource_group_name":{"type":"string","description":"The resource group for the machine that generated the MSI token. This information can be obtained through instance metadata.","description_kind":"plain","required":true},"role":{"type":"string","description":"Name of the login role.","description_kind":"plain","required":true},"scope":{"type":"string","description":"The scopes to include in the token request.","description_kind":"plain","optional":true},"subscription_id":{"type":"string","description":"The subscription ID for the machine that generated the MSI token. This information can be obtained through instance metadata.","description_kind":"plain","required":true},"tenant_id":{"type":"string","description":"Provides the tenant ID to use in a multi-tenant authentication scenario.","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true},"vm_name":{"type":"string","description":"The virtual machine name for the machine that generated the MSI token. This information can be obtained through instance metadata.","description_kind":"plain","optional":true},"vmss_name":{"type":"string","description":"The virtual machine scale set name for the machine that generated the MSI token. This information can be obtained through instance metadata.","description_kind":"plain","optional":true}},"description":"Login to vault using the azure method","description_kind":"plain"},"max_items":1},"auth_login_cert":{"nesting_mode":"list","block":{"attributes":{"cert_file":{"type":"string","description":"Path to a file containing the client certificate.","description_kind":"plain","required":true},"key_file":{"type":"string","description":"Path to a file containing the private key that the certificate was issued for.","description_kind":"plain","required":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the certificate's role","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the cert method","description_kind":"plain"},"max_items":1},"auth_login_gcp":{"nesting_mode":"list","block":{"attributes":{"credentials":{"type":"string","description":"Path to the Google Cloud credentials file.","description_kind":"plain","optional":true},"jwt":{"type":"string","description":"A signed JSON Web Token.","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the login role.","description_kind":"plain","required":true},"service_account":{"type":"string","description":"IAM service account.","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the gcp method","description_kind":"plain"},"max_items":1},"auth_login_jwt":{"nesting_mode":"list","block":{"attributes":{"jwt":{"type":"string","description":"A signed JSON Web Token.","description_kind":"plain","required":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the login role.","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the jwt method","description_kind":"plain"},"max_items":1},"auth_login_kerberos":{"nesting_mode":"list","block":{"attributes":{"disable_fast_negotiation":{"type":"bool","description":"Disable the Kerberos FAST negotiation.","description_kind":"plain","optional":true},"keytab_path":{"type":"string","description":"The Kerberos keytab file containing the entry of the login entity.","description_kind":"plain","optional":true},"krb5conf_path":{"type":"string","description":"A valid Kerberos configuration file e.g. /etc/krb5.conf.","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"realm":{"type":"string","description":"The Kerberos server's authoritative authentication domain","description_kind":"plain","optional":true},"remove_instance_name":{"type":"bool","description":"Strip the host from the username found in the keytab.","description_kind":"plain","optional":true},"service":{"type":"string","description":"The service principle name.","description_kind":"plain","optional":true},"token":{"type":"string","description":"Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) token","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true},"username":{"type":"string","description":"The username to login into Kerberos with.","description_kind":"plain","optional":true}},"description":"Login to vault using the kerberos method","description_kind":"plain"},"max_items":1},"auth_login_oci":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Authentication type to use when getting OCI credentials.","description_kind":"plain","required":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the login role.","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the OCI method","description_kind":"plain"},"max_items":1},"auth_login_oidc":{"nesting_mode":"list","block":{"attributes":{"callback_address":{"type":"string","description":"The callback address. Must be a valid URI without the path.","description_kind":"plain","optional":true},"callback_listener_address":{"type":"string","description":"The callback listener's address. Must be a valid URI without the path.","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the login role.","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the oidc method","description_kind":"plain"},"max_items":1},"auth_login_radius":{"nesting_mode":"list","block":{"attributes":{"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"password":{"type":"string","description":"The Radius password for username.","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true},"username":{"type":"string","description":"The Radius username.","description_kind":"plain","required":true}},"description":"Login to vault using the radius method","description_kind":"plain"},"max_items":1},"auth_login_token_file":{"nesting_mode":"list","block":{"attributes":{"filename":{"type":"string","description":"The name of a file containing a single line that is a valid Vault token","description_kind":"plain","required":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using ","description_kind":"plain"},"max_items":1},"auth_login_userpass":{"nesting_mode":"list","block":{"attributes":{"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"password":{"type":"string","description":"Login with password","description_kind":"plain","optional":true},"password_file":{"type":"string","description":"Login with password from a file","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true},"username":{"type":"string","description":"Login with username","description_kind":"plain","required":true}},"description":"Login to vault using the userpass method","description_kind":"plain"},"max_items":1},"client_auth":{"nesting_mode":"list","block":{"attributes":{"cert_file":{"type":"string","description":"Path to a file containing the client certificate.","description_kind":"plain","optional":true},"key_file":{"type":"string","description":"Path to a file containing the private key that the certificate was issued for.","description_kind":"plain","optional":true}},"description":"Client authentication credentials.","description_kind":"plain","deprecated":true},"max_items":1},"headers":{"nesting_mode":"list","block":{"attributes":{"name":{"type":"string","description":"The header name","description_kind":"plain","required":true},"value":{"type":"string","description":"The header value","description_kind":"plain","required":true}},"description":"The headers to send with each Vault request.","description_kind":"plain"}}},"description_kind":"plain"}},"resource_schemas":{"vault_ad_secret_backend":{"version":1,"block":{"attributes":{"anonymous_group_search":{"type":"bool","description":"Use anonymous binds when performing LDAP group searches (if true the initial credentials will still be used for the initial connection test).","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The mount path for a backend, for example, the path given in \"$ vault auth enable -path=my-ad ad\".","description_kind":"plain","optional":true},"binddn":{"type":"string","description":"Distinguished name of object to bind when performing user and group search.","description_kind":"plain","required":true},"bindpass":{"type":"string","description":"LDAP password for searching for the user DN.","description_kind":"plain","required":true,"sensitive":true},"case_sensitive_names":{"type":"bool","description":"If true, case sensitivity will be used when comparing usernames and groups for matching policies.","description_kind":"plain","optional":true},"certificate":{"type":"string","description":"CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.","description_kind":"plain","optional":true},"client_tls_cert":{"type":"string","description":"Client certificate to provide to the LDAP server, must be x509 PEM encoded.","description_kind":"plain","optional":true,"sensitive":true},"client_tls_key":{"type":"string","description":"Client certificate key to provide to the LDAP server, must be x509 PEM encoded.","description_kind":"plain","optional":true,"sensitive":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true,"computed":true},"deny_null_bind":{"type":"bool","description":"Denies an unauthenticated LDAP bind request if the user's password is empty; defaults to true","description_kind":"plain","optional":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"discoverdn":{"type":"bool","description":"Use anonymous bind to discover the bind DN of a user.","description_kind":"plain","optional":true},"groupattr":{"type":"string","description":"LDAP attribute to follow on objects returned by \u003cgroupfilter\u003e in order to enumerate user group membership. Examples: \"cn\" or \"memberOf\", etc. Default: cn","description_kind":"plain","optional":true},"groupdn":{"type":"string","description":"LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org)","description_kind":"plain","optional":true},"groupfilter":{"type":"string","description":"Go template for querying group membership of user. The template can access the following context variables: UserDN, Username Example: (\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}})) Default: (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"insecure_tls":{"type":"bool","description":"Skip LDAP server SSL Certificate verification - insecure and not recommended for production use.","description_kind":"plain","optional":true},"last_rotation_tolerance":{"type":"number","description":"The number of seconds after a Vault rotation where, if Active Directory shows a later rotation, it should be considered out-of-band.","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration to use when checking the last rotation time.","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds.","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"In seconds, the maximum password time-to-live.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"password_policy":{"type":"string","description":"Name of the password policy to use to generate passwords.","description_kind":"plain","optional":true},"request_timeout":{"type":"number","description":"Timeout, in seconds, for the connection when making requests against the server before returning back an error.","description_kind":"plain","optional":true},"starttls":{"type":"bool","description":"Issue a StartTLS command after establishing unencrypted connection.","description_kind":"plain","optional":true,"computed":true},"tls_max_version":{"type":"string","description":"Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'","description_kind":"plain","optional":true,"computed":true},"tls_min_version":{"type":"string","description":"Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'","description_kind":"plain","optional":true,"computed":true},"ttl":{"type":"number","description":"In seconds, the default password time-to-live.","description_kind":"plain","optional":true,"computed":true},"upndomain":{"type":"string","description":"Enables userPrincipalDomain login with [username]@UPNDomain.","description_kind":"plain","optional":true,"computed":true},"url":{"type":"string","description":"LDAP URL to connect to (default: ldap://127.0.0.1). Multiple URLs can be specified by concatenating them with commas; they will be tried in-order.","description_kind":"plain","optional":true},"use_pre111_group_cn_behavior":{"type":"bool","description":"In Vault 1.1.1 a fix for handling group CN values of different cases unfortunately introduced a regression that could cause previously defined groups to not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for matching group CNs will be used. This is only needed in some upgrade scenarios for backwards compatibility. It is enabled by default if the config is upgraded but disabled by default on new configurations.","description_kind":"plain","optional":true,"computed":true},"use_token_groups":{"type":"bool","description":"If true, use the Active Directory tokenGroups constructed attribute of the user to find the group memberships. This will find all security groups including nested ones.","description_kind":"plain","optional":true},"userattr":{"type":"string","description":"Attribute used for users (default: cn)","description_kind":"plain","optional":true},"userdn":{"type":"string","description":"LDAP domain to use for users (eg: ou=People,dc=example,dc=org)","description_kind":"plain","optional":true}},"description_kind":"plain","deprecated":true}},"vault_ad_secret_library":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The mount path for the AD backend.","description_kind":"plain","required":true},"disable_check_in_enforcement":{"type":"bool","description":"Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"The maximum amount of time, in seconds, a check-out last with renewal before Vault automatically checks it back in.","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the set of service accounts.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"service_account_names":{"type":["list","string"],"description":"The names of all the service accounts that can be checked out from this set. These service accounts must already exist in Active Directory.","description_kind":"plain","required":true},"ttl":{"type":"number","description":"The amount of time, in seconds, a single check-out lasts before Vault automatically checks it back in.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain","deprecated":true}},"vault_ad_secret_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The mount path for the AD backend.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"last_vault_rotation":{"type":"string","description":"Last time Vault rotated this service account's password.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"password_last_set":{"type":"string","description":"Last time Vault set this service account's password.","description_kind":"plain","computed":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"service_account_name":{"type":"string","description":"The username/logon name for the service account with which this role will be associated.","description_kind":"plain","required":true},"ttl":{"type":"number","description":"In seconds, the default password time-to-live.","description_kind":"plain","optional":true}},"description_kind":"plain","deprecated":true}},"vault_alicloud_auth_backend_role":{"version":0,"block":{"attributes":{"arn":{"type":"string","description":"The role's arn.","description_kind":"plain","required":true},"backend":{"type":"string","description":"Auth backend.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role. Must correspond with the name of the role reflected in the arn.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_approle_auth_backend_login":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor for the token.","description_kind":"plain","computed":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"client_token":{"type":"string","description":"The token.","description_kind":"plain","computed":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"How long the token is valid for.","description_kind":"plain","computed":true},"lease_started":{"type":"string","description":"The timestamp the lease started on, as determined by the machine running Terraform.","description_kind":"plain","computed":true},"metadata":{"type":["map","string"],"description":"Metadata associated with the token.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["list","string"],"description":"Policies set on the token.","description_kind":"plain","computed":true},"renewable":{"type":"bool","description":"Whether the token is renewable or not.","description_kind":"plain","computed":true},"role_id":{"type":"string","description":"The RoleID to log in with.","description_kind":"plain","required":true},"secret_id":{"type":"string","description":"The SecretID to log in with.","description_kind":"plain","optional":true,"sensitive":true}},"description_kind":"plain"}},"vault_approle_auth_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"bind_secret_id":{"type":"bool","description":"Whether or not to require secret_id to be present when logging in using this AppRole.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_id":{"type":"string","description":"The RoleID of the role. Autogenerated if not set.","description_kind":"plain","optional":true,"computed":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"secret_id_bound_cidrs":{"type":["set","string"],"description":"List of CIDR blocks that can log in using the AppRole.","description_kind":"plain","optional":true},"secret_id_num_uses":{"type":"number","description":"Number of times which a particular SecretID can be used to fetch a token from this AppRole, after which the SecretID will expire. Leaving this unset or setting it to 0 will allow unlimited uses.","description_kind":"plain","optional":true},"secret_id_ttl":{"type":"number","description":"Number of seconds a SecretID remains valid for.","description_kind":"plain","optional":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_approle_auth_backend_role_secret_id":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"The unique ID used to access this SecretID.","description_kind":"plain","computed":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"cidr_list":{"type":["set","string"],"description":"List of CIDR blocks that can log in using the SecretID.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"metadata":{"type":"string","description":"JSON-encoded secret data to write.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"secret_id":{"type":"string","description":"The SecretID to be managed. If not specified, Vault auto-generates one.","description_kind":"plain","optional":true,"computed":true,"sensitive":true},"with_wrapped_accessor":{"type":"bool","description":"Use the wrapped secret-id accessor as the id of this resource. If false, a fresh secret-id will be regenerated whenever the wrapping token is expired or invalidated through unwrapping.","description_kind":"plain","optional":true},"wrapping_accessor":{"type":"string","description":"The wrapped SecretID accessor.","description_kind":"plain","computed":true},"wrapping_token":{"type":"string","description":"The wrapped SecretID token.","description_kind":"plain","computed":true,"sensitive":true},"wrapping_ttl":{"type":"string","description":"The TTL duration of the wrapped SecretID.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_audit":{"version":0,"block":{"attributes":{"description":{"type":"string","description":"Human-friendly description of the audit device.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the audit device is a local only. Local audit devices are not replicated nor (if a secondary) removed by replication.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"Configuration options to pass to the audit device itself.","description_kind":"plain","required":true},"path":{"type":"string","description":"Path in which to enable the audit device.","description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of the audit device, such as 'file'.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_audit_request_header":{"version":0,"block":{"attributes":{"hmac":{"type":"bool","description":"Whether this header's value should be HMAC'd in the audit logs.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the request header to audit.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor of the auth backend","description_kind":"plain","computed":true},"description":{"type":"string","description":"The description of the auth backend","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the auth method is local only","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"path to mount the backend. This defaults to the type.","description_kind":"plain","optional":true,"computed":true},"tune":{"type":["set",["object",{"allowed_response_headers":["list","string"],"audit_non_hmac_request_keys":["list","string"],"audit_non_hmac_response_keys":["list","string"],"default_lease_ttl":"string","listing_visibility":"string","max_lease_ttl":"string","passthrough_request_headers":["list","string"],"token_type":"string"}]],"description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Name of the auth backend","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_aws_auth_backend_cert":{"version":0,"block":{"attributes":{"aws_public_cert":{"type":"string","description":"Base64 encoded AWS Public key required to verify PKCS7 signature of the EC2 instance metadata.","description_kind":"plain","required":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"cert_name":{"type":"string","description":"Name of the certificate to configure.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"type":{"type":"string","description":"The type of document that can be verified using the certificate. Must be either \"pkcs7\" or \"identity\".","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_client":{"version":0,"block":{"attributes":{"access_key":{"type":"string","description":"AWS Access key with permissions to query AWS APIs.","description_kind":"plain","optional":true,"sensitive":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"ec2_endpoint":{"type":"string","description":"URL to override the default generated endpoint for making AWS EC2 API calls.","description_kind":"plain","optional":true},"iam_endpoint":{"type":"string","description":"URL to override the default generated endpoint for making AWS IAM API calls.","description_kind":"plain","optional":true},"iam_server_id_header_value":{"type":"string","description":"The value to require in the X-Vault-AWS-IAM-Server-ID header as part of GetCallerIdentity requests that are used in the iam auth method.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"AWS Secret key with permissions to query AWS APIs.","description_kind":"plain","optional":true,"sensitive":true},"sts_endpoint":{"type":"string","description":"URL to override the default generated endpoint for making AWS STS API calls.","description_kind":"plain","optional":true},"sts_region":{"type":"string","description":"Region to override the default region for making AWS STS API calls.","description_kind":"plain","optional":true},"use_sts_region_from_client":{"type":"bool","description":"If set, will override sts_region and use the region from the client request's header","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_aws_auth_backend_config_identity":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"ec2_alias":{"type":"string","description":"Configures how to generate the identity alias when using the ec2 auth method.","description_kind":"plain","optional":true},"ec2_metadata":{"type":["set","string"],"description":"The metadata to include on the token returned by the login endpoint.","description_kind":"plain","optional":true},"iam_alias":{"type":"string","description":"How to generate the identity alias when using the iam auth method.","description_kind":"plain","optional":true},"iam_metadata":{"type":["set","string"],"description":"The metadata to include on the token returned by the login endpoint.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_identity_whitelist":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"disable_periodic_tidy":{"type":"bool","description":"If true, disables the periodic tidying of the identiy whitelist entries.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"safety_buffer":{"type":"number","description":"The amount of extra time that must have passed beyond the roletag expiration, before it's removed from backend storage.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_login":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor returned from Vault for this token.","description_kind":"plain","computed":true},"auth_type":{"type":"string","description":"The auth method used to generate this token.","description_kind":"plain","computed":true},"backend":{"type":"string","description":"AWS Auth Backend to read the token from.","description_kind":"plain","optional":true},"client_token":{"type":"string","description":"The token returned by Vault.","description_kind":"plain","computed":true,"sensitive":true},"iam_http_request_method":{"type":"string","description":"The HTTP method used in the signed request.","description_kind":"plain","optional":true},"iam_request_body":{"type":"string","description":"The Base64-encoded body of the signed request.","description_kind":"plain","optional":true},"iam_request_headers":{"type":"string","description":"The Base64-encoded, JSON serialized representation of the sts:GetCallerIdentity HTTP request headers.","description_kind":"plain","optional":true},"iam_request_url":{"type":"string","description":"The Base64-encoded HTTP URL used in the signed request.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"identity":{"type":"string","description":"Base64-encoded EC2 instance identity document to authenticate with.","description_kind":"plain","optional":true},"lease_duration":{"type":"number","description":"Lease duration in seconds relative to the time in lease_start_time.","description_kind":"plain","computed":true},"lease_start_time":{"type":"string","description":"Time at which the lease was read, using the clock of the system where Terraform was running","description_kind":"plain","computed":true},"metadata":{"type":["map","string"],"description":"The metadata reported by the Vault server.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"nonce":{"type":"string","description":"The nonce to be used for subsequent login requests.","description_kind":"plain","optional":true,"computed":true},"pkcs7":{"type":"string","description":"PKCS7 signature of the identity document to authenticate with, with all newline characters removed.","description_kind":"plain","optional":true},"policies":{"type":["list","string"],"description":"The policies assigned to this token.","description_kind":"plain","computed":true},"renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"role":{"type":"string","description":"AWS Auth Role to read the token from.","description_kind":"plain","optional":true,"computed":true},"signature":{"type":"string","description":"Base64-encoded SHA256 RSA signature of the instance identtiy document to authenticate with.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_role":{"version":0,"block":{"attributes":{"allow_instance_migration":{"type":"bool","description":"When true, allows migration of the underlying instance where the client resides. Use with caution.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"The auth type permitted for this role.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"bound_account_ids":{"type":["set","string"],"description":"Only EC2 instances with this account ID in their identity document will be permitted to log in.","description_kind":"plain","optional":true},"bound_ami_ids":{"type":["set","string"],"description":"Only EC2 instances using this AMI ID will be permitted to log in.","description_kind":"plain","optional":true},"bound_ec2_instance_ids":{"type":["set","string"],"description":"Only EC2 instances that match this instance ID will be permitted to log in.","description_kind":"plain","optional":true},"bound_iam_instance_profile_arns":{"type":["set","string"],"description":"Only EC2 instances associated with an IAM instance profile ARN that matches this value will be permitted to log in.","description_kind":"plain","optional":true},"bound_iam_principal_arns":{"type":["set","string"],"description":"The IAM principal that must be authenticated using the iam auth method.","description_kind":"plain","optional":true},"bound_iam_role_arns":{"type":["set","string"],"description":"Only EC2 instances that match this IAM role ARN will be permitted to log in.","description_kind":"plain","optional":true},"bound_regions":{"type":["set","string"],"description":"Only EC2 instances in this region will be permitted to log in.","description_kind":"plain","optional":true},"bound_subnet_ids":{"type":["set","string"],"description":"Only EC2 instances associated with this subnet ID will be permitted to log in.","description_kind":"plain","optional":true},"bound_vpc_ids":{"type":["set","string"],"description":"Only EC2 instances associated with this VPC ID will be permitted to log in.","description_kind":"plain","optional":true},"disallow_reauthentication":{"type":"bool","description":"When true, only allows a single token to be granted per instance ID.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"inferred_aws_region":{"type":"string","description":"The region to search for the inferred entities in.","description_kind":"plain","optional":true},"inferred_entity_type":{"type":"string","description":"The type of inferencing Vault should do.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"resolve_aws_unique_ids":{"type":"bool","description":"Whether or not Vault should resolve the bound_iam_principal_arn to an AWS Unique ID. When true, deleting a principal and recreating it with the same name won't automatically grant the new principal the same roles in Vault that the old principal had.","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"role_id":{"type":"string","description":"The Vault generated role ID.","description_kind":"plain","computed":true},"role_tag":{"type":"string","description":"The key of the tag on EC2 instance to use for role tags.","description_kind":"plain","optional":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_role_tag":{"version":0,"block":{"attributes":{"allow_instance_migration":{"type":"bool","description":"Allows migration of the underlying instance where the client resides.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"AWS auth backend to read tags from.","description_kind":"plain","optional":true},"disallow_reauthentication":{"type":"bool","description":"Only allow a single token to be granted per instance ID.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"instance_id":{"type":"string","description":"Instance ID for which this tag is intended. The created tag can only be used by the instance with the given ID.","description_kind":"plain","optional":true},"max_ttl":{"type":"string","description":"The maximum allowed lifetime of tokens issued using this role.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"Policies to be associated with the tag.","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"tag_key":{"type":"string","description_kind":"plain","computed":true},"tag_value":{"type":"string","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_aws_auth_backend_roletag_blacklist":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","required":true},"disable_periodic_tidy":{"type":"bool","description":"If true, disables the periodic tidying of the roletag blacklist entries.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"safety_buffer":{"type":"number","description":"The amount of extra time that must have passed beyond the roletag expiration, before it's removed from backend storage.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_sts_role":{"version":0,"block":{"attributes":{"account_id":{"type":"string","description":"AWS account ID to be associated with STS role.","description_kind":"plain","required":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"sts_role":{"type":"string","description":"AWS ARN for STS role to be assumed when interacting with the account specified.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_aws_secret_backend":{"version":1,"block":{"attributes":{"access_key":{"type":"string","description":"The AWS Access Key ID to use when generating new credentials.","description_kind":"plain","optional":true,"sensitive":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"iam_endpoint":{"type":"string","description":"Specifies a custom HTTP IAM endpoint to use.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"identity_token_audience":{"type":"string","description":"The audience claim value.","description_kind":"plain","optional":true},"identity_token_key":{"type":"string","description":"The key to use for signing identity tokens.","description_kind":"plain","optional":true},"identity_token_ttl":{"type":"number","description":"The TTL of generated identity tokens in seconds.","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the secret backend is local only","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to mount the backend at.","description_kind":"plain","optional":true},"region":{"type":"string","description":"The AWS region to make API calls against. Defaults to us-east-1.","description_kind":"plain","optional":true,"computed":true},"role_arn":{"type":"string","description":"Role ARN to assume for plugin identity token federation.","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"The AWS Secret Access Key to use when generating new credentials.","description_kind":"plain","optional":true,"sensitive":true},"sts_endpoint":{"type":"string","description":"Specifies a custom HTTP STS endpoint to use.","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_aws_secret_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the AWS Secret Backend the role belongs to.","description_kind":"plain","required":true},"credential_type":{"type":"string","description":"Role credential type.","description_kind":"plain","required":true},"default_sts_ttl":{"type":"number","description":"The default TTL in seconds for STS credentials. When a TTL is not specified when STS credentials are requested, and a default TTL is specified on the role, then this default TTL will be used. Valid only when credential_type is one of assumed_role or federation_token.","description_kind":"plain","optional":true,"computed":true},"iam_groups":{"type":["set","string"],"description":"A list of IAM group names. IAM users generated against this vault role will be added to these IAM Groups. For a credential type of assumed_role or federation_token, the policies sent to the corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the policies from each group in iam_groups combined with the policy_document and policy_arns parameters.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_sts_ttl":{"type":"number","description":"The max allowed TTL in seconds for STS credentials (credentials TTL are capped to max_sts_ttl). Valid only when credential_type is one of assumed_role or federation_token.","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name for the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"permissions_boundary_arn":{"type":"string","description":"The ARN of the AWS Permissions Boundary to attach to IAM users created in the role. Valid only when credential_type is iam_user. If not specified, then no permissions boundary policy will be attached.","description_kind":"plain","optional":true},"policy_arns":{"type":["set","string"],"description":"ARN for an existing IAM policy the role should use.","description_kind":"plain","optional":true},"policy_document":{"type":"string","description":"IAM policy the role should use in JSON format.","description_kind":"plain","optional":true},"role_arns":{"type":["set","string"],"description":"ARNs of AWS roles allowed to be assumed. Only valid when credential_type is 'assumed_role'","description_kind":"plain","optional":true},"user_path":{"type":"string","description":"The path for the user name. Valid only when credential_type is iam_user. Default is /","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_secret_backend_static_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path where the AWS secrets backend is mounted.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"rotation_period":{"type":"number","description":"How often Vault should rotate the password of the user entry.","description_kind":"plain","required":true},"username":{"type":"string","description":"The username of the existing AWS IAM user to manage password rotation for.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_azure_auth_backend_config":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"client_id":{"type":"string","description":"The client id for credentials to query the Azure APIs. Currently read permissions to query compute resources are required.","description_kind":"plain","optional":true,"sensitive":true},"client_secret":{"type":"string","description":"The client secret for credentials to query the Azure APIs","description_kind":"plain","optional":true,"sensitive":true},"environment":{"type":"string","description":"The Azure cloud environment. Valid values: AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"resource":{"type":"string","description":"The configured URL for the application registered in Azure Active Directory.","description_kind":"plain","required":true},"tenant_id":{"type":"string","description":"The tenant id for the Azure Active Directory organization.","description_kind":"plain","required":true,"sensitive":true}},"description_kind":"plain"}},"vault_azure_auth_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"bound_group_ids":{"type":["list","string"],"description":"The list of group ids that login is restricted to.","description_kind":"plain","optional":true},"bound_locations":{"type":["list","string"],"description":"The list of locations that login is restricted to.","description_kind":"plain","optional":true},"bound_resource_groups":{"type":["list","string"],"description":"The list of resource groups that login is restricted to.","description_kind":"plain","optional":true},"bound_scale_sets":{"type":["list","string"],"description":"The list of scale set names that the login is restricted to.","description_kind":"plain","optional":true},"bound_service_principal_ids":{"type":["list","string"],"description":"The list of Service Principal IDs that login is restricted to.","description_kind":"plain","optional":true},"bound_subscription_ids":{"type":["list","string"],"description":"The list of subscription IDs that login is restricted to.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_azure_secret_backend":{"version":1,"block":{"attributes":{"client_id":{"type":"string","description":"The client id for credentials to query the Azure APIs. Currently read permissions to query compute resources are required.","description_kind":"plain","optional":true,"sensitive":true},"client_secret":{"type":"string","description":"The client secret for credentials to query the Azure APIs","description_kind":"plain","optional":true,"sensitive":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"environment":{"type":"string","description":"The Azure cloud environment. Valid values: AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to mount the backend at.","description_kind":"plain","optional":true},"subscription_id":{"type":"string","description":"The subscription id for the Azure Active Directory.","description_kind":"plain","required":true,"sensitive":true},"tenant_id":{"type":"string","description":"The tenant id for the Azure Active Directory organization.","description_kind":"plain","required":true,"sensitive":true},"use_microsoft_graph_api":{"type":"bool","description":"Use the Microsoft Graph API. Should be set to true on vault-1.10+","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_azure_secret_backend_role":{"version":0,"block":{"attributes":{"application_object_id":{"type":"string","description":"Application Object ID for an existing service principal that will be used instead of creating dynamic service principals.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"permanently_delete":{"type":"bool","description":"Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire.","description_kind":"plain","optional":true,"computed":true},"role":{"type":"string","description":"Name of the role to create","description_kind":"plain","required":true},"sign_in_audience":{"type":"string","description":"Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount","description_kind":"plain","optional":true},"tags":{"type":["list","string"],"description":"Comma-separated strings of Azure tags to attach to an application.","description_kind":"plain","optional":true},"ttl":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true}},"block_types":{"azure_groups":{"nesting_mode":"set","block":{"attributes":{"group_name":{"type":"string","description_kind":"plain","required":true},"object_id":{"type":"string","description_kind":"plain","computed":true}},"description_kind":"plain"}},"azure_roles":{"nesting_mode":"set","block":{"attributes":{"role_id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"role_name":{"type":"string","description_kind":"plain","optional":true,"computed":true},"scope":{"type":"string","description_kind":"plain","required":true}},"description_kind":"plain"}}},"description_kind":"plain"}},"vault_cert_auth_backend_role":{"version":1,"block":{"attributes":{"allowed_common_names":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"allowed_dns_sans":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"allowed_email_sans":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"allowed_names":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"allowed_organizational_units":{"type":["set","string"],"description_kind":"plain","optional":true},"allowed_uri_sans":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"backend":{"type":"string","description_kind":"plain","optional":true},"certificate":{"type":"string","description_kind":"plain","required":true},"display_name":{"type":"string","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"ocsp_ca_certificates":{"type":"string","description":"Any additional CA certificates needed to verify OCSP responses. Provided as base64 encoded PEM data.","description_kind":"plain","optional":true},"ocsp_enabled":{"type":"bool","description":"If enabled, validate certificates' revocation status using OCSP.","description_kind":"plain","optional":true,"computed":true},"ocsp_fail_open":{"type":"bool","description":"If true and an OCSP response cannot be fetched or is of an unknown status, the login will proceed as if the certificate has not been revoked.","description_kind":"plain","optional":true,"computed":true},"ocsp_query_all_servers":{"type":"bool","description":"If set to true, rather than accepting the first successful OCSP response, query all servers and consider the certificate valid only if all servers agree.","description_kind":"plain","optional":true,"computed":true},"ocsp_servers_override":{"type":["set","string"],"description":"A comma-separated list of OCSP server addresses. If unset, the OCSP server is determined from the AuthorityInformationAccess extension on the certificate being inspected.","description_kind":"plain","optional":true},"required_extensions":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_config_ui_custom_message":{"version":0,"block":{"attributes":{"authenticated":{"type":"bool","description":"A flag indicating whether the custom message is displayed pre-login (false) or post-login (true)","description_kind":"plain","optional":true},"end_time":{"type":"string","description":"The ending time of the active period of the custom message. Can be omitted for non-expiring message","description_kind":"plain","optional":true},"id":{"type":"string","description":"The unique ID for the custom message","description_kind":"plain","computed":true},"message_base64":{"type":"string","description":"The base64-encoded content of the custom message","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"A map containing additional options for the custom message","description_kind":"plain","optional":true},"start_time":{"type":"string","description":"The starting time of the active period of the custom message","description_kind":"plain","required":true},"title":{"type":"string","description":"The title of the custom message","description_kind":"plain","required":true},"type":{"type":"string","description":"The display type of custom message. Allowed values are banner and modal","description_kind":"plain","optional":true}},"block_types":{"link":{"nesting_mode":"set","block":{"attributes":{"href":{"type":"string","description":"The URL of the hyperlink","description_kind":"plain","required":true},"title":{"type":"string","description":"The title of the hyperlink","description_kind":"plain","required":true}},"description":"A block containing a hyperlink associated with the custom message","description_kind":"plain"},"max_items":1}},"description_kind":"plain"}},"vault_consul_secret_backend":{"version":1,"block":{"attributes":{"address":{"type":"string","description":"Specifies the address of the Consul instance, provided as \"host:port\" like \"127.0.0.1:8500\".","description_kind":"plain","required":true},"bootstrap":{"type":"bool","description":"Denotes a backend resource that is used to bootstrap the Consul ACL system. Only one resource may be used to bootstrap.","description_kind":"plain","optional":true},"ca_cert":{"type":"string","description":"CA certificate to use when verifying Consul server certificate, must be x509 PEM encoded.","description_kind":"plain","optional":true},"client_cert":{"type":"string","description":"Client certificate used for Consul's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_key.","description_kind":"plain","optional":true,"sensitive":true},"client_key":{"type":"string","description":"Client key used for Consul's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert.","description_kind":"plain","optional":true,"sensitive":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the secret backend is local only","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Unique name of the Vault Consul mount to configure","description_kind":"plain","optional":true},"scheme":{"type":"string","description":"Specifies the URL scheme to use. Defaults to \"http\".","description_kind":"plain","optional":true},"token":{"type":"string","description":"Specifies the Consul token to use when managing or issuing new tokens.","description_kind":"plain","optional":true,"sensitive":true}},"description_kind":"plain"}},"vault_consul_secret_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the Consul Secret Backend the role belongs to.","description_kind":"plain","optional":true},"consul_namespace":{"type":"string","description":"The Consul namespace that the token will be created in. Applicable for Vault 1.10+ and Consul 1.7+","description_kind":"plain","optional":true,"computed":true},"consul_policies":{"type":["set","string"],"description":"List of Consul policies to associate with this role","description_kind":"plain","optional":true},"consul_roles":{"type":["set","string"],"description":"Set of Consul roles to attach to the token. Applicable for Vault 1.10+ with Consul 1.5+","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Indicates that the token should not be replicated globally and instead be local to the current datacenter.","description_kind":"plain","optional":true},"max_ttl":{"type":"number","description":"Maximum TTL for leases associated with this role, in seconds.","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of an existing role against which to create this Consul credential","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"node_identities":{"type":["set","string"],"description":"Set of Consul node identities to attach to\n\t\t\t\tthe token. Applicable for Vault 1.11+ with Consul 1.8+","description_kind":"plain","optional":true},"partition":{"type":"string","description":"The Consul admin partition that the token will be created in. Applicable for Vault 1.10+ and Consul 1.11+","description_kind":"plain","optional":true,"computed":true},"policies":{"type":["list","string"],"description":"List of Consul policies to associate with this role","description_kind":"plain","optional":true},"service_identities":{"type":["set","string"],"description":"Set of Consul service identities to attach to\n\t\t\t\tthe token. Applicable for Vault 1.11+ with Consul 1.5+","description_kind":"plain","optional":true},"ttl":{"type":"number","description":"Specifies the TTL for this role.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_database_secret_backend_connection":{"version":0,"block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the Vault mount to configure.","description_kind":"plain","required":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"block_types":{"cassandra":{"nesting_mode":"list","block":{"attributes":{"connect_timeout":{"type":"number","description":"The number of seconds to use as a connection timeout.","description_kind":"plain","optional":true},"hosts":{"type":["list","string"],"description":"Cassandra hosts to connect to.","description_kind":"plain","optional":true},"insecure_tls":{"type":"bool","description":"Whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The password to use when authenticating with Cassandra.","description_kind":"plain","optional":true,"sensitive":true},"pem_bundle":{"type":"string","description":"Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"pem_json":{"type":"string","description":"Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"port":{"type":"number","description":"The transport port to use to connect to Cassandra.","description_kind":"plain","optional":true},"protocol_version":{"type":"number","description":"The CQL protocol version to use.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Whether to use TLS when connecting to Cassandra.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The username to use when authenticating with Cassandra.","description_kind":"plain","optional":true}},"description":"Connection parameters for the cassandra-database-plugin plugin.","description_kind":"plain"},"max_items":1},"couchbase":{"nesting_mode":"list","block":{"attributes":{"base64_pem":{"type":"string","description":"Required if `tls` is `true`. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded.","description_kind":"plain","optional":true,"sensitive":true},"bucket_name":{"type":"string","description":"Required for Couchbase versions prior to 6.5.0. This is only used to verify vault's connection to the server.","description_kind":"plain","optional":true},"hosts":{"type":["list","string"],"description":"A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":" Specifies whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"tls":{"type":"bool","description":"Specifies whether to use TLS when connecting to Couchbase.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username for Vault to use.","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true}},"description":"Connection parameters for the couchbase-database-plugin plugin.","description_kind":"plain"},"max_items":1},"elasticsearch":{"nesting_mode":"list","block":{"attributes":{"ca_cert":{"type":"string","description":"The path to a PEM-encoded CA cert file to use to verify the Elasticsearch server's identity","description_kind":"plain","optional":true},"ca_path":{"type":"string","description":"The path to a directory of PEM-encoded CA cert files to use to verify the Elasticsearch server's identity","description_kind":"plain","optional":true},"client_cert":{"type":"string","description":"The path to the certificate for the Elasticsearch client to present for communication","description_kind":"plain","optional":true},"client_key":{"type":"string","description":"The path to the key for the Elasticsearch client to use for communication","description_kind":"plain","optional":true},"insecure":{"type":"bool","description":"Whether to disable certificate verification","description_kind":"plain","optional":true},"password":{"type":"string","description":"The password to be used in the connection URL","description_kind":"plain","required":true,"sensitive":true},"tls_server_name":{"type":"string","description":"This, if set, is used to set the SNI host when connecting via TLS","description_kind":"plain","optional":true},"url":{"type":"string","description":"The URL for Elasticsearch's API","description_kind":"plain","required":true},"username":{"type":"string","description":"The username to be used in the connection URL","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true}},"description":"Connection parameters for the elasticsearch-database-plugin.","description_kind":"plain"},"max_items":1},"hana":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true}},"description":"Connection parameters for the hana-database-plugin plugin.","description_kind":"plain"},"max_items":1},"influxdb":{"nesting_mode":"list","block":{"attributes":{"connect_timeout":{"type":"number","description":"The number of seconds to use as a connection timeout.","description_kind":"plain","optional":true},"host":{"type":"string","description":"Influxdb host to connect to.","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":"Whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"pem_bundle":{"type":"string","description":"Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"pem_json":{"type":"string","description":"Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"port":{"type":"number","description":"The transport port to use to connect to Influxdb.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Whether to use TLS when connecting to Influxdb.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username to use for superuser access.","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true}},"description":"Connection parameters for the influxdb-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mongodb":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mongodb-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mongodbatlas":{"nesting_mode":"list","block":{"attributes":{"private_key":{"type":"string","description":"The Private Programmatic API Key used to connect with MongoDB Atlas API.","description_kind":"plain","required":true,"sensitive":true},"project_id":{"type":"string","description":"The Project ID the Database User should be created within.","description_kind":"plain","required":true},"public_key":{"type":"string","description":"The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.","description_kind":"plain","required":true}},"description":"Connection parameters for the mongodbatlas-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mssql":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"contained_db":{"type":"bool","description":"Set to true when the target is a Contained Database, e.g. AzureSQL.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mssql-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mysql":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mysql_aurora":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-aurora-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mysql_legacy":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-legacy-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mysql_rds":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-rds-database-plugin plugin.","description_kind":"plain"},"max_items":1},"oracle":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"disconnect_sessions":{"type":"bool","description":"Set to true to disconnect any open sessions prior to running the revocation statements.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"split_statements":{"type":"bool","description":"Set to true in order to split statements after semi-colons.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the oracle-database-plugin plugin.","description_kind":"plain"},"max_items":1},"postgresql":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the postgresql-database-plugin plugin.","description_kind":"plain"},"max_items":1},"redis":{"nesting_mode":"list","block":{"attributes":{"ca_cert":{"type":"string","description":"The contents of a PEM-encoded CA cert file to use to verify the Redis server's identity.","description_kind":"plain","optional":true},"host":{"type":"string","description":"Specifies the host to connect to","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":"Specifies whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"port":{"type":"number","description":"The transport port to use to connect to Redis.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Specifies whether to use TLS when connecting to Redis.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username for Vault to use.","description_kind":"plain","required":true}},"description":"Connection parameters for the redis-database-plugin plugin.","description_kind":"plain"},"max_items":1},"redis_elasticache":{"nesting_mode":"list","block":{"attributes":{"password":{"type":"string","description":"The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.","description_kind":"plain","optional":true,"sensitive":true},"region":{"type":"string","description":"The AWS region where the ElastiCache cluster is hosted. If omitted the plugin tries to infer the region from the environment.","description_kind":"plain","optional":true},"url":{"type":"string","description":"The configuration endpoint for the ElastiCache cluster to connect to.","description_kind":"plain","required":true},"username":{"type":"string","description":"The AWS access key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.","description_kind":"plain","optional":true,"sensitive":true}},"description":"Connection parameters for the redis-elasticache-database-plugin plugin.","description_kind":"plain"},"max_items":1},"redshift":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the redshift-database-plugin plugin.","description_kind":"plain"},"max_items":1},"snowflake":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the snowflake-database-plugin plugin.","description_kind":"plain"},"max_items":1}},"description_kind":"plain"}},"vault_database_secret_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the Database Secret Backend the role belongs to.","description_kind":"plain","required":true},"creation_statements":{"type":["list","string"],"description":"Database statements to execute to create and configure a user.","description_kind":"plain","required":true},"credential_config":{"type":["map","string"],"description":"Specifies the configuration for the given credential_type.","description_kind":"plain","optional":true},"credential_type":{"type":"string","description":"Specifies the type of credential that will be generated for the role.","description_kind":"plain","optional":true,"computed":true},"db_name":{"type":"string","description":"Database connection to use for this role.","description_kind":"plain","required":true},"default_ttl":{"type":"number","description":"Default TTL for leases associated with this role, in seconds.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"Maximum TTL for leases associated with this role, in seconds.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Unique name for the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"renew_statements":{"type":["list","string"],"description":"Database statements to execute to renew a user.","description_kind":"plain","optional":true},"revocation_statements":{"type":["list","string"],"description":"Database statements to execute to revoke a user.","description_kind":"plain","optional":true},"rollback_statements":{"type":["list","string"],"description":"Database statements to execute to rollback a create operation in the event of an error.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_database_secret_backend_static_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the Database Secret Backend the role belongs to.","description_kind":"plain","required":true},"db_name":{"type":"string","description":"Database connection to use for this role.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name for the static role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"rotation_period":{"type":"number","description":"The amount of time Vault should wait before rotating the password, in seconds.","description_kind":"plain","optional":true},"rotation_schedule":{"type":"string","description":"A cron-style string that will define the schedule on which rotations should occur.","description_kind":"plain","optional":true},"rotation_statements":{"type":["list","string"],"description":"Database statements to execute to rotate the password for the configured database user.","description_kind":"plain","optional":true},"rotation_window":{"type":"number","description":"The amount of time in seconds in which the rotations are allowed to occur starting from a given rotation_schedule.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The database username that this role corresponds to.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_database_secrets_mount":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"Accessor of the mount","description_kind":"plain","computed":true},"allowed_managed_keys":{"type":["set","string"],"description":"List of managed key registry entry names that the mount in question is allowed to access","description_kind":"plain","optional":true},"audit_non_hmac_request_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.","description_kind":"plain","optional":true,"computed":true},"audit_non_hmac_response_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.","description_kind":"plain","optional":true,"computed":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount","description_kind":"plain","optional":true},"engine_count":{"type":"number","description":"Total number of database secret engines configured under the mount.","description_kind":"plain","computed":true},"external_entropy_access":{"type":"bool","description":"Enable the secrets engine to access Vault's external entropy source","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Local mount flag that can be explicitly set to true to enforce local mount in HA environment","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"Specifies mount type specific options that are passed to the backend","description_kind":"plain","optional":true},"path":{"type":"string","description":"Where the secret backend will be mounted","description_kind":"plain","required":true},"seal_wrap":{"type":"bool","description":"Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability","description_kind":"plain","optional":true,"computed":true}},"block_types":{"cassandra":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connect_timeout":{"type":"number","description":"The number of seconds to use as a connection timeout.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"hosts":{"type":["list","string"],"description":"Cassandra hosts to connect to.","description_kind":"plain","optional":true},"insecure_tls":{"type":"bool","description":"Whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The password to use when authenticating with Cassandra.","description_kind":"plain","optional":true,"sensitive":true},"pem_bundle":{"type":"string","description":"Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"pem_json":{"type":"string","description":"Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"port":{"type":"number","description":"The transport port to use to connect to Cassandra.","description_kind":"plain","optional":true},"protocol_version":{"type":"number","description":"The CQL protocol version to use.","description_kind":"plain","optional":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Whether to use TLS when connecting to Cassandra.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The username to use when authenticating with Cassandra.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the cassandra-database-plugin plugin.","description_kind":"plain"}},"couchbase":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"base64_pem":{"type":"string","description":"Required if `tls` is `true`. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded.","description_kind":"plain","optional":true,"sensitive":true},"bucket_name":{"type":"string","description":"Required for Couchbase versions prior to 6.5.0. This is only used to verify vault's connection to the server.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"hosts":{"type":["list","string"],"description":"A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":" Specifies whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Specifies whether to use TLS when connecting to Couchbase.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username for Vault to use.","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the couchbase-database-plugin plugin.","description_kind":"plain"}},"elasticsearch":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"ca_cert":{"type":"string","description":"The path to a PEM-encoded CA cert file to use to verify the Elasticsearch server's identity","description_kind":"plain","optional":true},"ca_path":{"type":"string","description":"The path to a directory of PEM-encoded CA cert files to use to verify the Elasticsearch server's identity","description_kind":"plain","optional":true},"client_cert":{"type":"string","description":"The path to the certificate for the Elasticsearch client to present for communication","description_kind":"plain","optional":true},"client_key":{"type":"string","description":"The path to the key for the Elasticsearch client to use for communication","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"insecure":{"type":"bool","description":"Whether to disable certificate verification","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The password to be used in the connection URL","description_kind":"plain","required":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"tls_server_name":{"type":"string","description":"This, if set, is used to set the SNI host when connecting via TLS","description_kind":"plain","optional":true},"url":{"type":"string","description":"The URL for Elasticsearch's API","description_kind":"plain","required":true},"username":{"type":"string","description":"The username to be used in the connection URL","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the elasticsearch-database-plugin.","description_kind":"plain"}},"hana":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the hana-database-plugin plugin.","description_kind":"plain"}},"influxdb":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connect_timeout":{"type":"number","description":"The number of seconds to use as a connection timeout.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"host":{"type":"string","description":"Influxdb host to connect to.","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":"Whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"pem_bundle":{"type":"string","description":"Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"pem_json":{"type":"string","description":"Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"port":{"type":"number","description":"The transport port to use to connect to Influxdb.","description_kind":"plain","optional":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Whether to use TLS when connecting to Influxdb.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username to use for superuser access.","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the influxdb-database-plugin plugin.","description_kind":"plain"}},"mongodb":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mongodb-database-plugin plugin.","description_kind":"plain"}},"mongodbatlas":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"private_key":{"type":"string","description":"The Private Programmatic API Key used to connect with MongoDB Atlas API.","description_kind":"plain","required":true,"sensitive":true},"project_id":{"type":"string","description":"The Project ID the Database User should be created within.","description_kind":"plain","required":true},"public_key":{"type":"string","description":"The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.","description_kind":"plain","required":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mongodbatlas-database-plugin plugin.","description_kind":"plain"}},"mssql":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"contained_db":{"type":"bool","description":"Set to true when the target is a Contained Database, e.g. AzureSQL.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mssql-database-plugin plugin.","description_kind":"plain"}},"mysql":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-database-plugin plugin.","description_kind":"plain"}},"mysql_aurora":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-aurora-database-plugin plugin.","description_kind":"plain"}},"mysql_legacy":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-legacy-database-plugin plugin.","description_kind":"plain"}},"mysql_rds":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-rds-database-plugin plugin.","description_kind":"plain"}},"oracle":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"disconnect_sessions":{"type":"bool","description":"Set to true to disconnect any open sessions prior to running the revocation statements.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"split_statements":{"type":"bool","description":"Set to true in order to split statements after semi-colons.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the oracle-database-plugin plugin.","description_kind":"plain"}},"postgresql":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the postgresql-database-plugin plugin.","description_kind":"plain"}},"redis":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"ca_cert":{"type":"string","description":"The contents of a PEM-encoded CA cert file to use to verify the Redis server's identity.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"host":{"type":"string","description":"Specifies the host to connect to","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":"Specifies whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"port":{"type":"number","description":"The transport port to use to connect to Redis.","description_kind":"plain","optional":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Specifies whether to use TLS when connecting to Redis.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username for Vault to use.","description_kind":"plain","required":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the redis-database-plugin plugin.","description_kind":"plain"}},"redis_elasticache":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"region":{"type":"string","description":"The AWS region where the ElastiCache cluster is hosted. If omitted the plugin tries to infer the region from the environment.","description_kind":"plain","optional":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"url":{"type":"string","description":"The configuration endpoint for the ElastiCache cluster to connect to.","description_kind":"plain","required":true},"username":{"type":"string","description":"The AWS access key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.","description_kind":"plain","optional":true,"sensitive":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the redis-elasticache-database-plugin plugin.","description_kind":"plain"}},"redshift":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the redshift-database-plugin plugin.","description_kind":"plain"}},"snowflake":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the snowflake-database-plugin plugin.","description_kind":"plain"}}},"description_kind":"plain"}},"vault_egp_policy":{"version":0,"block":{"attributes":{"enforcement_level":{"type":"string","description":"Enforcement level of Sentinel policy. Can be one of: 'advisory', 'soft-mandatory' or 'hard-mandatory'","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the policy","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"paths":{"type":["list","string"],"description":"List of paths to which the policy will be applied","description_kind":"plain","required":true},"policy":{"type":"string","description":"The policy document","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_gcp_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor of the auth backend","description_kind":"plain","computed":true},"client_email":{"type":"string","description_kind":"plain","optional":true,"computed":true},"client_id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"credentials":{"type":"string","description_kind":"plain","optional":true,"sensitive":true},"description":{"type":"string","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the auth method is local only","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description_kind":"plain","optional":true},"private_key_id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"project_id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"tune":{"type":["set",["object",{"allowed_response_headers":["list","string"],"audit_non_hmac_request_keys":["list","string"],"audit_non_hmac_response_keys":["list","string"],"default_lease_ttl":"string","listing_visibility":"string","max_lease_ttl":"string","passthrough_request_headers":["list","string"],"token_type":"string"}]],"description_kind":"plain","optional":true,"computed":true}},"block_types":{"custom_endpoint":{"nesting_mode":"list","block":{"attributes":{"api":{"type":"string","description":"Replaces the service endpoint used in API requests to https://www.googleapis.com.","description_kind":"plain","optional":true},"compute":{"type":"string","description":"Replaces the service endpoint used in API requests to `https://compute.googleapis.com`.","description_kind":"plain","optional":true},"crm":{"type":"string","description":"Replaces the service endpoint used in API requests to `https://cloudresourcemanager.googleapis.com`.","description_kind":"plain","optional":true},"iam":{"type":"string","description":"Replaces the service endpoint used in API requests to `https://iam.googleapis.com`.","description_kind":"plain","optional":true}},"description":"Specifies overrides to service endpoints used when making API requests to GCP.","description_kind":"plain"},"max_items":1}},"description_kind":"plain"}},"vault_gcp_auth_backend_role":{"version":1,"block":{"attributes":{"add_group_aliases":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"allow_gce_inference":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"backend":{"type":"string","description_kind":"plain","optional":true},"bound_instance_groups":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"bound_labels":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"bound_projects":{"type":["set","string"],"description_kind":"plain","optional":true},"bound_regions":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"bound_service_accounts":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"bound_zones":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_jwt_exp":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true},"type":{"type":"string","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_gcp_secret_backend":{"version":1,"block":{"attributes":{"credentials":{"type":"string","description":"JSON-encoded credentials to use to connect to GCP","description_kind":"plain","optional":true,"sensitive":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Local mount flag that can be explicitly set to true to enforce local mount in HA environment","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to mount the backend at.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_gcp_secret_impersonated_account":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Path where the GCP secrets engine is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"impersonated_account":{"type":"string","description":"Name of the Impersonated Account to create","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"service_account_email":{"type":"string","description":"Email of the GCP service account.","description_kind":"plain","required":true},"service_account_project":{"type":"string","description":"Project of the GCP Service Account managed by this impersonated account","description_kind":"plain","computed":true},"token_scopes":{"type":["set","string"],"description":"List of OAuth scopes to assign to `access_token` secrets generated under this impersonated account (`access_token` impersonated accounts only) ","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_gcp_secret_roleset":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Path where the GCP secrets engine is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"project":{"type":"string","description":"Name of the GCP project that this roleset's service account will belong to.","description_kind":"plain","required":true},"roleset":{"type":"string","description":"Name of the RoleSet to create","description_kind":"plain","required":true},"secret_type":{"type":"string","description":"Type of secret generated for this role set. Defaults to `access_token`. Accepted values: `access_token`, `service_account_key`","description_kind":"plain","optional":true,"computed":true},"service_account_email":{"type":"string","description":"Email of the service account created by Vault for this Roleset","description_kind":"plain","computed":true},"token_scopes":{"type":["set","string"],"description":"List of OAuth scopes to assign to `access_token` secrets generated under this role set (`access_token` role sets only) ","description_kind":"plain","optional":true}},"block_types":{"binding":{"nesting_mode":"set","block":{"attributes":{"resource":{"type":"string","description":"Resource name","description_kind":"plain","required":true},"roles":{"type":["set","string"],"description":"List of roles to apply to the resource","description_kind":"plain","required":true}},"description_kind":"plain"},"min_items":1}},"description_kind":"plain"}},"vault_gcp_secret_static_account":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Path where the GCP secrets engine is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_type":{"type":"string","description":"Type of secret generated for this static account. Defaults to `access_token`. Accepted values: `access_token`, `service_account_key`","description_kind":"plain","optional":true,"computed":true},"service_account_email":{"type":"string","description":"Email of the GCP service account.","description_kind":"plain","required":true},"service_account_project":{"type":"string","description":"Project of the GCP Service Account managed by this static account","description_kind":"plain","computed":true},"static_account":{"type":"string","description":"Name of the Static Account to create","description_kind":"plain","required":true},"token_scopes":{"type":["set","string"],"description":"List of OAuth scopes to assign to `access_token` secrets generated under this static account (`access_token` static accounts only) ","description_kind":"plain","optional":true}},"block_types":{"binding":{"nesting_mode":"set","block":{"attributes":{"resource":{"type":"string","description":"Resource name","description_kind":"plain","required":true},"roles":{"type":["set","string"],"description":"List of roles to apply to the resource","description_kind":"plain","required":true}},"description_kind":"plain"}}},"description_kind":"plain"}},"vault_generic_endpoint":{"version":1,"block":{"attributes":{"data_json":{"type":"string","description":"JSON-encoded data to write.","description_kind":"plain","required":true,"sensitive":true},"disable_delete":{"type":"bool","description":"Don't attempt to delete the path from Vault if true","description_kind":"plain","optional":true},"disable_read":{"type":"bool","description":"Don't attempt to read the path from Vault if true; drift won't be detected","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ignore_absent_fields":{"type":"bool","description":"When reading, disregard fields not present in data_json","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where to the endpoint that will be written","description_kind":"plain","required":true},"write_data":{"type":["map","string"],"description":"Map of strings returned by write operation","description_kind":"plain","computed":true},"write_data_json":{"type":"string","description":"JSON data returned by write operation","description_kind":"plain","computed":true},"write_fields":{"type":["list","string"],"description":"Top-level fields returned by write to persist in state","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_generic_secret":{"version":1,"block":{"attributes":{"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data to write.","description_kind":"plain","required":true,"sensitive":true},"delete_all_versions":{"type":"bool","description":"Only applicable for kv-v2 stores. If set, permanently deletes all versions for the specified key.","description_kind":"plain","optional":true},"disable_read":{"type":"bool","description":"Don't attempt to read the token from Vault if true; drift won't be detected.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where the generic secret will be written.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_github_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The mount accessor related to the auth mount.","description_kind":"plain","computed":true},"base_url":{"type":"string","description":"The API endpoint to use. Useful if you are running GitHub Enterprise or an API-compatible authentication server.","description_kind":"plain","optional":true},"description":{"type":"string","description":"Specifies the description of the mount. This overrides the current stored value, if any.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"The organization users must be part of.","description_kind":"plain","required":true},"organization_id":{"type":"number","description":"The ID of the organization users must be part of. Vault will attempt to fetch and set this value if it is not provided (vault-1.10+)","description_kind":"plain","optional":true,"computed":true},"path":{"type":"string","description":"Path where the auth backend is mounted","description_kind":"plain","optional":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true},"tune":{"type":["set",["object",{"allowed_response_headers":["list","string"],"audit_non_hmac_request_keys":["list","string"],"audit_non_hmac_response_keys":["list","string"],"default_lease_ttl":"string","listing_visibility":"string","max_lease_ttl":"string","passthrough_request_headers":["list","string"],"token_type":"string"}]],"description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_github_team":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Auth backend to which team mapping will be configured.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["list","string"],"description":"Policies to be assigned to this team.","description_kind":"plain","optional":true},"team":{"type":"string","description":"GitHub team name in \"slugified\" format.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_github_user":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Auth backend to which user mapping will be congigured.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["list","string"],"description":"Policies to be assigned to this user.","description_kind":"plain","optional":true},"user":{"type":"string","description":"GitHub user name.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_identity_entity":{"version":0,"block":{"attributes":{"disabled":{"type":"bool","description":"Whether the entity is disabled. Disabled entities' associated tokens cannot be used, but are not revoked.","description_kind":"plain","optional":true},"external_policies":{"type":"bool","description":"Manage policies externally through `vault_identity_entity_policies`.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"metadata":{"type":["map","string"],"description":"Metadata to be associated with the entity.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the entity.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"Policies to be tied to the entity.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_entity_alias":{"version":0,"block":{"attributes":{"canonical_id":{"type":"string","description":"ID of the entity to which this is an alias.","description_kind":"plain","required":true},"custom_metadata":{"type":["map","string"],"description":"Custom metadata to be associated with this alias.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount_accessor":{"type":"string","description":"Mount accessor to which this alias belongs toMount accessor to which this alias belongs to.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the entity alias.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_entity_policies":{"version":0,"block":{"attributes":{"entity_id":{"type":"string","description":"ID of the entity.","description_kind":"plain","required":true},"entity_name":{"type":"string","description":"Name of the entity.","description_kind":"plain","computed":true},"exclusive":{"type":"bool","description":"Should the resource manage policies exclusively","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"Policies to be tied to the entity.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_identity_group":{"version":1,"block":{"attributes":{"external_member_entity_ids":{"type":"bool","description":"Manage member entities externally through `vault_identity_group_member_entity_ids`","description_kind":"plain","optional":true},"external_member_group_ids":{"type":"bool","description":"Manage member groups externally through `vault_identity_group_member_group_ids`","description_kind":"plain","optional":true},"external_policies":{"type":"bool","description":"Manage policies externally through `vault_identity_group_policies`, allows using group ID in assigned policies.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"member_entity_ids":{"type":["set","string"],"description":"Entity IDs to be assigned as group members.","description_kind":"plain","optional":true},"member_group_ids":{"type":["set","string"],"description":"Group IDs to be assigned as group members.","description_kind":"plain","optional":true},"metadata":{"type":["map","string"],"description":"Metadata to be associated with the group.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the group.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"Policies to be tied to the group.","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of the group, internal or external. Defaults to internal.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_group_alias":{"version":0,"block":{"attributes":{"canonical_id":{"type":"string","description":"ID of the group to which this is an alias.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount_accessor":{"type":"string","description":"Mount accessor to which this alias belongs to.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the group alias.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_group_member_entity_ids":{"version":0,"block":{"attributes":{"exclusive":{"type":"bool","description":"If set to true, allows the resource to manage member entity ids\nexclusively. Beware of race conditions when disabling exclusive management","description_kind":"plain","optional":true},"group_id":{"type":"string","description":"ID of the group.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"member_entity_ids":{"type":["set","string"],"description":"Entity IDs to be assigned as group members.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_group_member_group_ids":{"version":0,"block":{"attributes":{"exclusive":{"type":"bool","description":"If set to true, allows the resource to manage member group ids\nexclusively. Beware of race conditions when disabling exclusive management","description_kind":"plain","optional":true},"group_id":{"type":"string","description":"ID of the group.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"member_group_ids":{"type":["set","string"],"description":"Group IDs to be assigned as group members.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_group_policies":{"version":0,"block":{"attributes":{"exclusive":{"type":"bool","description":"Should the resource manage policies exclusively? Beware of race conditions when disabling exclusive management","description_kind":"plain","optional":true},"group_id":{"type":"string","description":"ID of the group.","description_kind":"plain","required":true},"group_name":{"type":"string","description":"Name of the group.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"Policies to be tied to the group.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_identity_mfa_duo":{"version":0,"block":{"attributes":{"api_hostname":{"type":"string","description":"API hostname for Duo","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"integration_key":{"type":"string","description":"Integration key for Duo","description_kind":"plain","required":true,"sensitive":true},"method_id":{"type":"string","description":"Method ID.","description_kind":"plain","computed":true},"mount_accessor":{"type":"string","description":"Mount accessor.","description_kind":"plain","computed":true},"name":{"type":"string","description":"Method name.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Method's namespace ID.","description_kind":"plain","computed":true},"namespace_path":{"type":"string","description":"Method's namespace path.","description_kind":"plain","computed":true},"push_info":{"type":"string","description":"Push information for Duo.","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"Secret key for Duo","description_kind":"plain","required":true,"sensitive":true},"type":{"type":"string","description":"MFA type.","description_kind":"plain","computed":true},"use_passcode":{"type":"bool","description":"Require passcode upon MFA validation.","description_kind":"plain","optional":true},"username_format":{"type":"string","description":"A template string for mapping Identity names to MFA methods.","description_kind":"plain","optional":true},"uuid":{"type":"string","description":"Resource UUID.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_mfa_login_enforcement":{"version":0,"block":{"attributes":{"auth_method_accessors":{"type":["set","string"],"description":"Set of auth method accessor IDs.","description_kind":"plain","optional":true},"auth_method_types":{"type":["set","string"],"description":"Set of auth method types.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"identity_entity_ids":{"type":["set","string"],"description":"Set of identity entity IDs.","description_kind":"plain","optional":true},"identity_group_ids":{"type":["set","string"],"description":"Set of identity group IDs.","description_kind":"plain","optional":true},"mfa_method_ids":{"type":["set","string"],"description":"Set of MFA method UUIDs.","description_kind":"plain","required":true},"name":{"type":"string","description":"Login enforcement name.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Method's namespace ID.","description_kind":"plain","computed":true},"namespace_path":{"type":"string","description":"Method's namespace path.","description_kind":"plain","computed":true},"uuid":{"type":"string","description":"Resource UUID.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_mfa_okta":{"version":0,"block":{"attributes":{"api_token":{"type":"string","description":"Okta API token.","description_kind":"plain","required":true,"sensitive":true},"base_url":{"type":"string","description":"The base domain to use for API requests.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"method_id":{"type":"string","description":"Method ID.","description_kind":"plain","computed":true},"mount_accessor":{"type":"string","description":"Mount accessor.","description_kind":"plain","computed":true},"name":{"type":"string","description":"Method name.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Method's namespace ID.","description_kind":"plain","computed":true},"namespace_path":{"type":"string","description":"Method's namespace path.","description_kind":"plain","computed":true},"org_name":{"type":"string","description":"Name of the organization to be used in the Okta API.","description_kind":"plain","required":true},"primary_email":{"type":"bool","description":"Only match the primary email for the account.","description_kind":"plain","optional":true},"type":{"type":"string","description":"MFA type.","description_kind":"plain","computed":true},"username_format":{"type":"string","description":"A template string for mapping Identity names to MFA methods.","description_kind":"plain","optional":true},"uuid":{"type":"string","description":"Resource UUID.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_mfa_pingid":{"version":0,"block":{"attributes":{"admin_url":{"type":"string","description":"The admin URL, derived from \"settings_file_base64\"","description_kind":"plain","computed":true},"authenticator_url":{"type":"string","description":"A unique identifier of the organization, derived from \"settings_file_base64\"","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"idp_url":{"type":"string","description":"The IDP URL, derived from \"settings_file_base64\"","description_kind":"plain","computed":true},"method_id":{"type":"string","description":"Method ID.","description_kind":"plain","computed":true},"mount_accessor":{"type":"string","description":"Mount accessor.","description_kind":"plain","computed":true},"name":{"type":"string","description":"Method name.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Method's namespace ID.","description_kind":"plain","computed":true},"namespace_path":{"type":"string","description":"Method's namespace path.","description_kind":"plain","computed":true},"org_alias":{"type":"string","description":"The name of the PingID client organization, derived from \"settings_file_base64\"","description_kind":"plain","computed":true},"settings_file_base64":{"type":"string","description":"A base64-encoded third-party settings contents as retrieved from PingID's configuration page.","description_kind":"plain","required":true},"type":{"type":"string","description":"MFA type.","description_kind":"plain","computed":true},"use_signature":{"type":"bool","description":"Use signature value, derived from \"settings_file_base64\"","description_kind":"plain","computed":true},"username_format":{"type":"string","description":"A template string for mapping Identity names to MFA methods.","description_kind":"plain","optional":true},"uuid":{"type":"string","description":"Resource UUID.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_mfa_totp":{"version":0,"block":{"attributes":{"algorithm":{"type":"string","description":"Specifies the hashing algorithm used to generate the TOTP code. Options include SHA1, SHA256, SHA512.","description_kind":"plain","optional":true},"digits":{"type":"number","description":"The number of digits in the generated TOTP token. This value can either be 6 or 8","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"The name of the key's issuing organization.","description_kind":"plain","required":true},"key_size":{"type":"number","description":"Specifies the size in bytes of the generated key.","description_kind":"plain","optional":true},"max_validation_attempts":{"type":"number","description":"The maximum number of consecutive failed validation attempts allowed.","description_kind":"plain","optional":true},"method_id":{"type":"string","description":"Method ID.","description_kind":"plain","computed":true},"mount_accessor":{"type":"string","description":"Mount accessor.","description_kind":"plain","computed":true},"name":{"type":"string","description":"Method name.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Method's namespace ID.","description_kind":"plain","computed":true},"namespace_path":{"type":"string","description":"Method's namespace path.","description_kind":"plain","computed":true},"period":{"type":"number","description":"The length of time in seconds used to generate a counter for the TOTP token calculation.","description_kind":"plain","optional":true},"qr_size":{"type":"number","description":"The pixel size of the generated square QR code.","description_kind":"plain","optional":true,"computed":true},"skew":{"type":"number","description":"The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.","description_kind":"plain","optional":true},"type":{"type":"string","description":"MFA type.","description_kind":"plain","computed":true},"uuid":{"type":"string","description":"Resource UUID.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_oidc":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"Issuer URL to be used in the iss claim of the token. If not set, Vault's api_addr will be used. The issuer is a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components, but no query or fragment components.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_assignment":{"version":0,"block":{"attributes":{"entity_ids":{"type":["set","string"],"description":"A list of Vault entity IDs.","description_kind":"plain","optional":true},"group_ids":{"type":["set","string"],"description":"A list of Vault group IDs.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the assignment.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_client":{"version":0,"block":{"attributes":{"access_token_ttl":{"type":"number","description":"The time-to-live for access tokens obtained by the client.","description_kind":"plain","optional":true,"computed":true},"assignments":{"type":["set","string"],"description":"A list of assignment resources associated with the client.","description_kind":"plain","optional":true},"client_id":{"type":"string","description":"The Client ID from Vault.","description_kind":"plain","computed":true},"client_secret":{"type":"string","description":"The Client Secret from Vault.","description_kind":"plain","computed":true,"sensitive":true},"client_type":{"type":"string","description":"The client type based on its ability to maintain confidentiality of credentials.Defaults to 'confidential'.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"id_token_ttl":{"type":"number","description":"The time-to-live for ID tokens obtained by the client. The value should be less than the verification_ttl on the key.","description_kind":"plain","optional":true,"computed":true},"key":{"type":"string","description":"A reference to a named key resource in Vault. This cannot be modified after creation.","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the client.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"redirect_uris":{"type":["set","string"],"description":"Redirection URI values used by the client. One of these values must exactly match the redirect_uri parameter value used in each authentication request.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_key":{"version":0,"block":{"attributes":{"algorithm":{"type":"string","description":"Signing algorithm to use. Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512, EdDSA.","description_kind":"plain","optional":true},"allowed_client_ids":{"type":["set","string"],"description":"Array of role client ids allowed to use this key for signing. If empty, no roles are allowed. If \"*\", all roles are allowed.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the key.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"rotation_period":{"type":"number","description":"How often to generate a new signing key in number of seconds","description_kind":"plain","optional":true},"verification_ttl":{"type":"number","description":"Controls how long the public portion of a signing key will be available for verification after being rotated in seconds.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_key_allowed_client_id":{"version":0,"block":{"attributes":{"allowed_client_id":{"type":"string","description":"Role Client ID allowed to use the key for signing.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_name":{"type":"string","description":"Name of the key.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_provider":{"version":0,"block":{"attributes":{"allowed_client_ids":{"type":["set","string"],"description":"The client IDs that are permitted to use the provider. If empty, no clients are allowed. If \"*\", all clients are allowed.","description_kind":"plain","optional":true},"https_enabled":{"type":"bool","description":"Set to true if the issuer endpoint uses HTTPS.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"Specifies what will be used as the 'scheme://host:port' component for the 'iss' claim of ID tokens.This value is computed using the issuer_host and https_enabled fields.","description_kind":"plain","computed":true},"issuer_host":{"type":"string","description":"The host for the issuer. Can be either host or host:port.","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of the provider.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"scopes_supported":{"type":["set","string"],"description":"The scopes available for requesting on the provider.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_role":{"version":0,"block":{"attributes":{"client_id":{"type":"string","description":"The value that will be included in the `aud` field of all the OIDC identity tokens issued by this role","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key":{"type":"string","description":"A configured named key, the key must already exist.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"template":{"type":"string","description":"The template string to use for generating tokens. This may be in string-ified JSON or base64 format.","description_kind":"plain","optional":true},"ttl":{"type":"number","description":"TTL of the tokens generated against the role in number of seconds.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_scope":{"version":0,"block":{"attributes":{"description":{"type":"string","description":"The scope's description.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the scope. The openid scope name is reserved.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"template":{"type":"string","description":"The template string for the scope. This may be provided as escaped JSON or base64 encoded JSON.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_jwt_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor of the JWT auth backend","description_kind":"plain","computed":true},"bound_issuer":{"type":"string","description":"The value against which to match the iss claim in a JWT","description_kind":"plain","optional":true},"default_role":{"type":"string","description":"The default role to use if none is provided during login","description_kind":"plain","optional":true},"description":{"type":"string","description":"The description of the auth backend","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"jwks_ca_pem":{"type":"string","description":"The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.","description_kind":"plain","optional":true},"jwks_url":{"type":"string","description":"JWKS URL to use to authenticate signatures. Cannot be used with 'oidc_discovery_url' or 'jwt_validation_pubkeys'.","description_kind":"plain","optional":true},"jwt_supported_algs":{"type":["list","string"],"description":"A list of supported signing algorithms. Defaults to [RS256]","description_kind":"plain","optional":true},"jwt_validation_pubkeys":{"type":["list","string"],"description":"A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with 'jwks_url' or 'oidc_discovery_url'. ","description_kind":"plain","optional":true},"local":{"type":"bool","description":"Specifies if the auth method is local only","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_in_state":{"type":"bool","description":"Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs.","description_kind":"plain","optional":true},"oidc_client_id":{"type":"string","description":"Client ID used for OIDC","description_kind":"plain","optional":true},"oidc_client_secret":{"type":"string","description":"Client Secret used for OIDC","description_kind":"plain","optional":true,"sensitive":true},"oidc_discovery_ca_pem":{"type":"string","description":"The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used","description_kind":"plain","optional":true},"oidc_discovery_url":{"type":"string","description":"The OIDC Discovery URL, without any .well-known component (base path). Cannot be used with 'jwks_url' or 'jwt_validation_pubkeys'.","description_kind":"plain","optional":true},"oidc_response_mode":{"type":"string","description":"The response mode to be used in the OAuth2 request. Allowed values are 'query' and 'form_post'. Defaults to 'query'. If using Vault namespaces, and oidc_response_mode is 'form_post', then 'namespace_in_state' should be set to false.","description_kind":"plain","optional":true},"oidc_response_types":{"type":["list","string"],"description":"The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'. Note: 'id_token' may only be used if 'oidc_response_mode' is set to 'form_post'.","description_kind":"plain","optional":true},"path":{"type":"string","description":"path to mount the backend","description_kind":"plain","optional":true},"provider_config":{"type":["map","string"],"description":"Provider specific handling configuration","description_kind":"plain","optional":true},"tune":{"type":["set",["object",{"allowed_response_headers":["list","string"],"audit_non_hmac_request_keys":["list","string"],"audit_non_hmac_response_keys":["list","string"],"default_lease_ttl":"string","listing_visibility":"string","max_lease_ttl":"string","passthrough_request_headers":["list","string"],"token_type":"string"}]],"description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of backend. Can be either 'jwt' or 'oidc'","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_jwt_auth_backend_role":{"version":0,"block":{"attributes":{"allowed_redirect_uris":{"type":["set","string"],"description":"The list of allowed values for redirect_uri during OIDC logins.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"bound_audiences":{"type":["set","string"],"description":"List of aud claims to match against. Any match is sufficient.","description_kind":"plain","optional":true},"bound_claims":{"type":["map","string"],"description":"Map of claims/values to match against. The expected value may be a single string or a comma-separated string list.","description_kind":"plain","optional":true},"bound_claims_type":{"type":"string","description":"How to interpret values in the claims/values map: can be either \"string\" (exact match) or \"glob\" (wildcard match).","description_kind":"plain","optional":true,"computed":true},"bound_subject":{"type":"string","description":"If set, requires that the sub claim matches this value.","description_kind":"plain","optional":true},"claim_mappings":{"type":["map","string"],"description":"Map of claims (keys) to be copied to specified metadata fields (values).","description_kind":"plain","optional":true},"clock_skew_leeway":{"type":"number","description":"The amount of leeway to add to all claims to account for clock skew, in seconds. Defaults to 60 seconds if set to 0 and can be disabled if set to -1. Only applicable with 'jwt' roles.","description_kind":"plain","optional":true},"disable_bound_claims_parsing":{"type":"bool","description":"Disable bound claim value parsing. Useful when values contain commas.","description_kind":"plain","optional":true},"expiration_leeway":{"type":"number","description":"The amount of leeway to add to expiration (exp) claims to account for clock skew, in seconds. Defaults to 60 seconds if set to 0 and can be disabled if set to -1. Only applicable with 'jwt' roles.","description_kind":"plain","optional":true},"groups_claim":{"type":"string","description":"The claim to use to uniquely identify the set of groups to which the user belongs; this will be used as the names for the Identity group aliases created due to a successful login. The claim value must be a list of strings.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_age":{"type":"number","description":"Specifies the allowable elapsed time in seconds since the last time the user was actively authenticated.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"not_before_leeway":{"type":"number","description":"The amount of leeway to add to not before (nbf) claims to account for clock skew, in seconds. Defaults to 150 seconds if set to 0 and can be disabled if set to -1. Only applicable with 'jwt' roles. ","description_kind":"plain","optional":true},"oidc_scopes":{"type":["set","string"],"description":"List of OIDC scopes to be used with an OIDC role. The standard scope \"openid\" is automatically included and need not be specified.","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"role_type":{"type":"string","description":"Type of role, either \"oidc\" (default) or \"jwt\"","description_kind":"plain","optional":true,"computed":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true},"user_claim":{"type":"string","description":"The claim to use to uniquely identify the user; this will be used as the name for the Identity entity alias created due to a successful login.","description_kind":"plain","required":true},"user_claim_json_pointer":{"type":"bool","description":"Specifies if the user_claim value uses JSON pointer syntax for referencing claims. By default, the user_claim value will not use JSON pointer.","description_kind":"plain","optional":true},"verbose_oidc_logging":{"type":"bool","description":"Log received OIDC tokens and claims when debug-level logging is active. Not recommended in production since sensitive information may be present in OIDC responses.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kmip_secret_backend":{"version":1,"block":{"attributes":{"default_tls_client_key_bits":{"type":"number","description":"Client certificate key bits, valid values depend on key type","description_kind":"plain","optional":true,"computed":true},"default_tls_client_key_type":{"type":"string","description":"Client certificate key type, rsa or ec","description_kind":"plain","optional":true,"computed":true},"default_tls_client_ttl":{"type":"number","description":"Client certificate TTL in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"listen_addrs":{"type":["set","string"],"description":"Addresses the KMIP server should listen on (host:port)","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path where KMIP secret backend will be mounted","description_kind":"plain","required":true},"server_hostnames":{"type":["set","string"],"description":"Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN)","description_kind":"plain","optional":true,"computed":true},"server_ips":{"type":["set","string"],"description":"IPs to include in the server's TLS certificate as SAN IP addresses","description_kind":"plain","optional":true,"computed":true},"tls_ca_key_bits":{"type":"number","description":"CA key bits, valid values depend on key type","description_kind":"plain","optional":true,"computed":true},"tls_ca_key_type":{"type":"string","description":"CA key type, rsa or ec","description_kind":"plain","optional":true,"computed":true},"tls_min_version":{"type":"string","description":"Minimum TLS version to accept","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_kmip_secret_role":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"operation_activate":{"type":"bool","description":"Grant permission to use the KMIP Activate operation","description_kind":"plain","optional":true,"computed":true},"operation_add_attribute":{"type":"bool","description":"Grant permission to use the KMIP Add Attribute operation","description_kind":"plain","optional":true,"computed":true},"operation_all":{"type":"bool","description":"Grant all permissions to this role. May not be specified with any other operation_* params","description_kind":"plain","optional":true,"computed":true},"operation_create":{"type":"bool","description":"Grant permission to use the KMIP Create operation","description_kind":"plain","optional":true,"computed":true},"operation_destroy":{"type":"bool","description":"Grant permission to use the KMIP Destroy operation","description_kind":"plain","optional":true,"computed":true},"operation_discover_versions":{"type":"bool","description":"Grant permission to use the KMIP Discover Version operation","description_kind":"plain","optional":true,"computed":true},"operation_get":{"type":"bool","description":"Grant permission to use the KMIP Get operation","description_kind":"plain","optional":true,"computed":true},"operation_get_attribute_list":{"type":"bool","description":"Grant permission to use the KMIP Get Attribute List operation","description_kind":"plain","optional":true,"computed":true},"operation_get_attributes":{"type":"bool","description":"Grant permission to use the KMIP Get Attributes operation","description_kind":"plain","optional":true,"computed":true},"operation_locate":{"type":"bool","description":"Grant permission to use the KMIP Locate operation","description_kind":"plain","optional":true,"computed":true},"operation_none":{"type":"bool","description":"Remove all permissions from this role. May not be specified with any other operation_* params","description_kind":"plain","optional":true,"computed":true},"operation_register":{"type":"bool","description":"Grant permission to use the KMIP Register operation","description_kind":"plain","optional":true,"computed":true},"operation_rekey":{"type":"bool","description":"Grant permission to use the KMIP Rekey operation","description_kind":"plain","optional":true,"computed":true},"operation_revoke":{"type":"bool","description":"Grant permission to use the KMIP Revoke operation","description_kind":"plain","optional":true,"computed":true},"path":{"type":"string","description":"Path where KMIP backend is mounted","description_kind":"plain","required":true},"role":{"type":"string","description":"Name of the role","description_kind":"plain","required":true},"scope":{"type":"string","description":"Name of the scope","description_kind":"plain","required":true},"tls_client_key_bits":{"type":"number","description":"Client certificate key bits, valid values depend on key type","description_kind":"plain","optional":true},"tls_client_key_type":{"type":"string","description":"Client certificate key type, rsa or ec","description_kind":"plain","optional":true},"tls_client_ttl":{"type":"number","description":"Client certificate TTL in seconds","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kmip_secret_scope":{"version":0,"block":{"attributes":{"force":{"type":"bool","description":"Force deletion even if there are managed objects in the scope","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path where KMIP backend is mounted","description_kind":"plain","required":true},"scope":{"type":"string","description":"Name of the scope","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_kubernetes_auth_backend_config":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the kubernetes backend to configure.","description_kind":"plain","optional":true},"disable_iss_validation":{"type":"bool","description":"Optional disable JWT issuer validation. Allows to skip ISS validation.","description_kind":"plain","optional":true,"computed":true},"disable_local_ca_jwt":{"type":"bool","description":"Optional disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"Optional JWT issuer. If no issuer is specified, kubernetes.io/serviceaccount will be used as the default issuer.","description_kind":"plain","optional":true},"kubernetes_ca_cert":{"type":"string","description":"PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.","description_kind":"plain","optional":true,"computed":true},"kubernetes_host":{"type":"string","description":"Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"pem_keys":{"type":["list","string"],"description":"Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys.","description_kind":"plain","optional":true},"token_reviewer_jwt":{"type":"string","description":"A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API.","description_kind":"plain","optional":true,"sensitive":true}},"description_kind":"plain"}},"vault_kubernetes_auth_backend_role":{"version":0,"block":{"attributes":{"alias_name_source":{"type":"string","description":"Configures how identity aliases are generated. Valid choices are: serviceaccount_uid, serviceaccount_name","description_kind":"plain","optional":true,"computed":true},"audience":{"type":"string","description":"Optional Audience claim to verify in the JWT.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the kubernetes backend to configure.","description_kind":"plain","optional":true},"bound_service_account_names":{"type":["set","string"],"description":"List of service account names able to access this role. If set to `[\"*\"]` all names are allowed, both this and bound_service_account_namespaces can not be \"*\".","description_kind":"plain","required":true},"bound_service_account_namespaces":{"type":["set","string"],"description":"List of namespaces allowed to access this role. If set to `[\"*\"]` all namespaces are allowed, both this and bound_service_account_names can not be set to \"*\".","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kubernetes_secret_backend":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"Accessor of the mount","description_kind":"plain","computed":true},"allowed_managed_keys":{"type":["set","string"],"description":"List of managed key registry entry names that the mount in question is allowed to access","description_kind":"plain","optional":true},"audit_non_hmac_request_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.","description_kind":"plain","optional":true,"computed":true},"audit_non_hmac_response_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.","description_kind":"plain","optional":true,"computed":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount","description_kind":"plain","optional":true},"disable_local_ca_jwt":{"type":"bool","description":"Disable defaulting to the local CA certificate and service account JWT when running in a Kubernetes pod.","description_kind":"plain","optional":true},"external_entropy_access":{"type":"bool","description":"Enable the secrets engine to access Vault's external entropy source","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"kubernetes_ca_cert":{"type":"string","description":"A PEM-encoded CA certificate used by the secret engine to verify the Kubernetes API server certificate. Defaults to the local pod’s CA if found, or otherwise the host's root CA set.","description_kind":"plain","optional":true},"kubernetes_host":{"type":"string","description":"The Kubernetes API URL to connect to.","description_kind":"plain","optional":true},"local":{"type":"bool","description":"Local mount flag that can be explicitly set to true to enforce local mount in HA environment","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"Specifies mount type specific options that are passed to the backend","description_kind":"plain","optional":true},"path":{"type":"string","description":"Where the secret backend will be mounted","description_kind":"plain","required":true},"seal_wrap":{"type":"bool","description":"Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability","description_kind":"plain","optional":true,"computed":true},"service_account_jwt":{"type":"string","description":"The JSON web token of the service account used by the secrets engine to manage Kubernetes credentials. Defaults to the local pod’s JWT if found.","description_kind":"plain","optional":true,"sensitive":true}},"description_kind":"plain"}},"vault_kubernetes_secret_backend_role":{"version":0,"block":{"attributes":{"allowed_kubernetes_namespace_selector":{"type":"string","description":"A label selector for Kubernetes namespaces in which credentials can begenerated. Accepts either a JSON or YAML object. The value should be of typeLabelSelector. If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed.","description_kind":"plain","optional":true},"allowed_kubernetes_namespaces":{"type":["list","string"],"description":"The list of Kubernetes namespaces this role can generate credentials for. If set to '*' all namespaces are allowed. If set with`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The mount path for the Kubernetes secrets engine.","description_kind":"plain","required":true},"extra_annotations":{"type":["map","string"],"description":"Additional annotations to apply to all generated Kubernetes objects.","description_kind":"plain","optional":true},"extra_labels":{"type":["map","string"],"description":"Additional labels to apply to all generated Kubernetes objects.","description_kind":"plain","optional":true},"generated_role_rules":{"type":"string","description":"The Role or ClusterRole rules to use when generating a role. Accepts either JSON or YAML formatted rules. Mutually exclusive with 'service_account_name' and 'kubernetes_role_name'. If set, the entire chain of Kubernetes objects will be generated when credentials are requested.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"kubernetes_role_name":{"type":"string","description":"The pre-existing Role or ClusterRole to bind a generated service account to. Mutually exclusive with 'service_account_name' and 'generated_role_rules'. If set, Kubernetes token, service account, and role binding objects will be created when credentials are requested.","description_kind":"plain","optional":true},"kubernetes_role_type":{"type":"string","description":"Specifies whether the Kubernetes role is a Role or ClusterRole.","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of the role.","description_kind":"plain","required":true},"name_template":{"type":"string","description":"The name template to use when generating service accounts, roles and role bindings. If unset, a default template is used.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"service_account_name":{"type":"string","description":"The pre-existing service account to generate tokens for. Mutually exclusive with 'kubernetes_role_name' and 'generated_role_rules'. If set, only a Kubernetes token will be created when credentials are requested.","description_kind":"plain","optional":true},"token_default_ttl":{"type":"number","description":"The default TTL for generated Kubernetes tokens in seconds.","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum TTL for generated Kubernetes tokens in seconds.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kv_secret":{"version":0,"block":{"attributes":{"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data to write.","description_kind":"plain","required":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path of the KV-V1 secret.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_kv_secret_backend_v2":{"version":0,"block":{"attributes":{"cas_required":{"type":"bool","description":"If true, all keys will require the cas parameter to be set on all write requests.","description_kind":"plain","optional":true,"computed":true},"delete_version_after":{"type":"number","description":"If set, specifies the length of time before a version is deleted","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_versions":{"type":"number","description":"The number of versions to keep per key.","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Path where KV-V2 engine is mounted.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kv_secret_v2":{"version":0,"block":{"attributes":{"cas":{"type":"number","description":"This flag is required if cas_required is set to true on either the secret or the engine's config. In order for a write to be successful, cas must be set to the current version of the secret.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data to write.","description_kind":"plain","required":true,"sensitive":true},"delete_all_versions":{"type":"bool","description":"If set to true, permanently deletes all versions for the specified key.","description_kind":"plain","optional":true},"disable_read":{"type":"bool","description":"If set to true, disables reading secret from Vault; note: drift won't be detected.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"metadata":{"type":["map","string"],"description":"Metadata associated with this secret read from Vault.","description_kind":"plain","computed":true},"mount":{"type":"string","description":"Path where KV-V2 engine is mounted.","description_kind":"plain","required":true},"name":{"type":"string","description":"Full name of the secret. For a nested secret, the name is the nested path excluding the mount and data prefix. For example, for a secret at 'kvv2/data/foo/bar/baz', the name is 'foo/bar/baz'","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"An object that holds option settings.","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where the KV-V2 secret will be written.","description_kind":"plain","computed":true}},"block_types":{"custom_metadata":{"nesting_mode":"list","block":{"attributes":{"cas_required":{"type":"bool","description":"If true, all keys will require the cas parameter to be set on all write requests.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of arbitrary string to string valued user-provided metadata meant to describe the secret.","description_kind":"plain","optional":true},"delete_version_after":{"type":"number","description":"If set, specifies the length of time before a version is deleted.","description_kind":"plain","optional":true},"max_versions":{"type":"number","description":"The number of versions to keep per key.","description_kind":"plain","optional":true}},"description":"Custom metadata to be set for the secret.","description_kind":"plain"},"max_items":1}},"description_kind":"plain"}},"vault_ldap_auth_backend":{"version":2,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor of the LDAP auth backend","description_kind":"plain","computed":true},"binddn":{"type":"string","description_kind":"plain","optional":true,"computed":true},"bindpass":{"type":"string","description_kind":"plain","optional":true,"computed":true,"sensitive":true},"case_sensitive_names":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"certificate":{"type":"string","description_kind":"plain","optional":true,"computed":true},"client_tls_cert":{"type":"string","description_kind":"plain","optional":true,"computed":true},"client_tls_key":{"type":"string","description_kind":"plain","optional":true,"computed":true,"sensitive":true},"deny_null_bind":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description_kind":"plain","optional":true,"computed":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"discoverdn":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"groupattr":{"type":"string","description_kind":"plain","optional":true,"computed":true},"groupdn":{"type":"string","description_kind":"plain","optional":true,"computed":true},"groupfilter":{"type":"string","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"insecure_tls":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the auth method is local only","description_kind":"plain","optional":true},"max_page_size":{"type":"number","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description_kind":"plain","optional":true},"starttls":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"tls_max_version":{"type":"string","description_kind":"plain","optional":true,"computed":true},"tls_min_version":{"type":"string","description_kind":"plain","optional":true,"computed":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true},"upndomain":{"type":"string","description_kind":"plain","optional":true,"computed":true},"url":{"type":"string","description_kind":"plain","required":true},"use_token_groups":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"userattr":{"type":"string","description_kind":"plain","optional":true,"computed":true},"userdn":{"type":"string","description_kind":"plain","optional":true,"computed":true},"userfilter":{"type":"string","description_kind":"plain","optional":true,"computed":true},"username_as_alias":{"type":"bool","description":"Force the auth method to use the username passed by the user as the alias name.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_ldap_auth_backend_group":{"version":1,"block":{"attributes":{"backend":{"type":"string","description_kind":"plain","optional":true},"groupname":{"type":"string","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_ldap_auth_backend_user":{"version":1,"block":{"attributes":{"backend":{"type":"string","description_kind":"plain","optional":true},"groups":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"username":{"type":"string","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_ldap_secret_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"Accessor of the mount","description_kind":"plain","computed":true},"allowed_managed_keys":{"type":["set","string"],"description":"List of managed key registry entry names that the mount in question is allowed to access","description_kind":"plain","optional":true},"audit_non_hmac_request_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.","description_kind":"plain","optional":true,"computed":true},"audit_non_hmac_response_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.","description_kind":"plain","optional":true,"computed":true},"binddn":{"type":"string","description":"Distinguished name of object to bind when performing user and group search.","description_kind":"plain","required":true},"bindpass":{"type":"string","description":"LDAP password for searching for the user DN.","description_kind":"plain","required":true,"sensitive":true},"certificate":{"type":"string","description":"CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.","description_kind":"plain","optional":true},"client_tls_cert":{"type":"string","description":"Client certificate to provide to the LDAP server, must be x509 PEM encoded.","description_kind":"plain","optional":true,"sensitive":true},"client_tls_key":{"type":"string","description":"Client certificate key to provide to the LDAP server, must be x509 PEM encoded.","description_kind":"plain","optional":true,"sensitive":true},"connection_timeout":{"type":"number","description":"Timeout, in seconds, when attempting to connect to the LDAP server before trying the next URL in the configuration.","description_kind":"plain","optional":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"external_entropy_access":{"type":"bool","description":"Enable the secrets engine to access Vault's external entropy source","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"insecure_tls":{"type":"bool","description":"Skip LDAP server SSL Certificate verification - insecure and not recommended for production use.","description_kind":"plain","optional":true},"local":{"type":"bool","description":"Local mount flag that can be explicitly set to true to enforce local mount in HA environment","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"Specifies mount type specific options that are passed to the backend","description_kind":"plain","optional":true},"password_policy":{"type":"string","description":"Name of the password policy to use to generate passwords.","description_kind":"plain","optional":true},"path":{"type":"string","description":"The path where the LDAP secrets backend is mounted.","description_kind":"plain","optional":true},"request_timeout":{"type":"number","description":"Timeout, in seconds, for the connection when making requests against the server before returning back an error.","description_kind":"plain","optional":true,"computed":true},"schema":{"type":"string","description":"The LDAP schema to use when storing entry passwords. Valid schemas include openldap, ad, and racf.","description_kind":"plain","optional":true,"computed":true},"seal_wrap":{"type":"bool","description":"Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability","description_kind":"plain","optional":true,"computed":true},"skip_static_role_import_rotation":{"type":"bool","description":"Skip rotation of static role secrets on import.","description_kind":"plain","optional":true},"starttls":{"type":"bool","description":"Issue a StartTLS command after establishing unencrypted connection.","description_kind":"plain","optional":true,"computed":true},"upndomain":{"type":"string","description":"Enables userPrincipalDomain login with [username]@UPNDomain.","description_kind":"plain","optional":true,"computed":true},"url":{"type":"string","description":"LDAP URL to connect to (default: ldap://127.0.0.1). Multiple URLs can be specified by concatenating them with commas; they will be tried in-order.","description_kind":"plain","optional":true,"computed":true},"userattr":{"type":"string","description":"Attribute used for users (default: cn)","description_kind":"plain","optional":true,"computed":true},"userdn":{"type":"string","description":"LDAP domain to use for users (eg: ou=People,dc=example,dc=org)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_ldap_secret_backend_dynamic_role":{"version":0,"block":{"attributes":{"creation_ldif":{"type":"string","description":"A templatized LDIF string used to create a user account. May contain multiple entries.","description_kind":"plain","required":true},"default_ttl":{"type":"number","description":"Specifies the TTL for the leases associated with this role.","description_kind":"plain","optional":true},"deletion_ldif":{"type":"string","description":"A templatized LDIF string used to delete the user account once its TTL has expired. This may contain multiple LDIF entries.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"Specifies the maximum TTL for the leases associated with this role.","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the LDAP secrets backend is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"rollback_ldif":{"type":"string","description":"A templatized LDIF string used to attempt to rollback any changes in the event that execution of the creation_ldif results in an error. This may contain multiple LDIF entries.","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"A template used to generate a dynamic username. This will be used to fill in the .Username field within the creation_ldif string.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_ldap_secret_backend_library_set":{"version":0,"block":{"attributes":{"disable_check_in_enforcement":{"type":"bool","description":"Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"The maximum amount of time a check-out last with renewal before Vault automatically checks it back in. Defaults to 24 hours.","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"The path where the LDAP secrets backend is mounted.","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of the set of service accounts.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"service_account_names":{"type":["list","string"],"description":"The names of all the service accounts that can be checked out from this set.","description_kind":"plain","required":true},"ttl":{"type":"number","description":"The maximum amount of time a single check-out lasts before Vault automatically checks it back in. Defaults to 24 hours.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_ldap_secret_backend_static_role":{"version":0,"block":{"attributes":{"dn":{"type":"string","description":"Distinguished name (DN) of the existing LDAP entry to manage password rotation for.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"The path where the LDAP secrets backend is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"rotation_period":{"type":"number","description":"How often Vault should rotate the password of the user entry.","description_kind":"plain","required":true},"skip_import_rotation":{"type":"bool","description":"Skip rotation of the password on import.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The username of the existing LDAP entry to manage password rotation for.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_managed_keys":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"block_types":{"aws":{"nesting_mode":"set","block":{"attributes":{"access_key":{"type":"string","description":"The AWS access key to use","description_kind":"plain","required":true},"allow_generate_key":{"type":"bool","description":"If no existing key can be found in the referenced backend, instructs Vault to generate a key within the backend","description_kind":"plain","optional":true,"computed":true},"allow_replace_key":{"type":"bool","description":"Controls the ability for Vault to replace through generation or importing a key into the configured backend even if a key is present, if set to false those operations are forbidden if a key exists.","description_kind":"plain","optional":true,"computed":true},"allow_store_key":{"type":"bool","description":"Controls the ability for Vault to import a key to the configured backend, if 'false', those operations will be forbidden","description_kind":"plain","optional":true,"computed":true},"any_mount":{"type":"bool","description":"Allow usage from any mount point within the namespace if 'true'","description_kind":"plain","optional":true,"computed":true},"curve":{"type":"string","description":"The curve to use for an ECDSA key. Used when key_type is 'ECDSA'. Required if 'allow_generate_key' is true","description_kind":"plain","optional":true},"endpoint":{"type":"string","description":"Used to specify a custom AWS endpoint","description_kind":"plain","optional":true},"key_bits":{"type":"string","description":"The size in bits for an RSA key. This field is required when 'key_type' is 'RSA'","description_kind":"plain","required":true},"key_type":{"type":"string","description":"The type of key to use","description_kind":"plain","required":true},"kms_key":{"type":"string","description":"An identifier for the key","description_kind":"plain","required":true},"name":{"type":"string","description":"A unique lowercase name that serves as identifying the key","description_kind":"plain","required":true},"region":{"type":"string","description":"The AWS region where the keys are stored (or will be stored)","description_kind":"plain","optional":true,"computed":true},"secret_key":{"type":"string","description":"The AWS secret key to use","description_kind":"plain","required":true},"uuid":{"type":"string","description":"ID of the managed key read from Vault","description_kind":"plain","computed":true}},"description":"Configuration block for AWS Managed Keys","description_kind":"plain"}},"azure":{"nesting_mode":"set","block":{"attributes":{"allow_generate_key":{"type":"bool","description":"If no existing key can be found in the referenced backend, instructs Vault to generate a key within the backend","description_kind":"plain","optional":true,"computed":true},"allow_replace_key":{"type":"bool","description":"Controls the ability for Vault to replace through generation or importing a key into the configured backend even if a key is present, if set to false those operations are forbidden if a key exists.","description_kind":"plain","optional":true,"computed":true},"allow_store_key":{"type":"bool","description":"Controls the ability for Vault to import a key to the configured backend, if 'false', those operations will be forbidden","description_kind":"plain","optional":true,"computed":true},"any_mount":{"type":"bool","description":"Allow usage from any mount point within the namespace if 'true'","description_kind":"plain","optional":true,"computed":true},"client_id":{"type":"string","description":"The client id for credentials to query the Azure APIs","description_kind":"plain","required":true},"client_secret":{"type":"string","description":"The client secret for credentials to query the Azure APIs","description_kind":"plain","required":true},"environment":{"type":"string","description":"The Azure Cloud environment API endpoints to use","description_kind":"plain","optional":true,"computed":true},"key_bits":{"type":"string","description":"The size in bits for an RSA key. This field is required when 'key_type' is 'RSA' or when 'allow_generate_key' is true","description_kind":"plain","optional":true},"key_name":{"type":"string","description":"The Key Vault key to use for encryption and decryption","description_kind":"plain","required":true},"key_type":{"type":"string","description":"The type of key to use","description_kind":"plain","required":true},"name":{"type":"string","description":"A unique lowercase name that serves as identifying the key","description_kind":"plain","required":true},"resource":{"type":"string","description":"The Azure Key Vault resource's DNS Suffix to connect to","description_kind":"plain","optional":true,"computed":true},"tenant_id":{"type":"string","description":"The tenant id for the Azure Active Directory organization","description_kind":"plain","required":true},"uuid":{"type":"string","description":"ID of the managed key read from Vault","description_kind":"plain","computed":true},"vault_name":{"type":"string","description":"The Key Vault vault to use the encryption keys for encryption and decryption","description_kind":"plain","required":true}},"description":"Configuration block for Azure Managed Keys","description_kind":"plain"}},"pkcs":{"nesting_mode":"set","block":{"attributes":{"allow_generate_key":{"type":"bool","description":"If no existing key can be found in the referenced backend, instructs Vault to generate a key within the backend","description_kind":"plain","optional":true,"computed":true},"allow_replace_key":{"type":"bool","description":"Controls the ability for Vault to replace through generation or importing a key into the configured backend even if a key is present, if set to false those operations are forbidden if a key exists.","description_kind":"plain","optional":true,"computed":true},"allow_store_key":{"type":"bool","description":"Controls the ability for Vault to import a key to the configured backend, if 'false', those operations will be forbidden","description_kind":"plain","optional":true,"computed":true},"any_mount":{"type":"bool","description":"Allow usage from any mount point within the namespace if 'true'","description_kind":"plain","optional":true,"computed":true},"curve":{"type":"string","description":"Supplies the curve value when using the 'CKM_ECDSA' mechanism. Required if 'allow_generate_key' is true","description_kind":"plain","optional":true},"force_rw_session":{"type":"string","description":"Force all operations to open up a read-write session to the HSM","description_kind":"plain","optional":true},"key_bits":{"type":"string","description":"Supplies the size in bits of the key when using 'CKM_RSA_PKCS_PSS', 'CKM_RSA_PKCS_OAEP' or 'CKM_RSA_PKCS' as a value for 'mechanism'. Required if 'allow_generate_key' is true","description_kind":"plain","optional":true},"key_id":{"type":"string","description":"The id of a PKCS#11 key to use","description_kind":"plain","required":true},"key_label":{"type":"string","description":"The label of the key to use","description_kind":"plain","required":true},"library":{"type":"string","description":"The name of the kms_library stanza to use from Vault's config to lookup the local library path","description_kind":"plain","required":true},"mechanism":{"type":"string","description":"The encryption/decryption mechanism to use, specified as a hexadecimal (prefixed by 0x) string.","description_kind":"plain","required":true},"name":{"type":"string","description":"A unique lowercase name that serves as identifying the key","description_kind":"plain","required":true},"pin":{"type":"string","description":"The PIN for login","description_kind":"plain","required":true},"slot":{"type":"string","description":"The slot number to use, specified as a string in a decimal format (e.g. '2305843009213693953')","description_kind":"plain","optional":true},"token_label":{"type":"string","description":"The slot token label to use","description_kind":"plain","optional":true},"uuid":{"type":"string","description":"ID of the managed key read from Vault","description_kind":"plain","computed":true}},"description":"Configuration block for PKCS Managed Keys","description_kind":"plain"}}},"description_kind":"plain"}},"vault_mfa_duo":{"version":0,"block":{"attributes":{"api_hostname":{"type":"string","description":"API hostname for Duo.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"integration_key":{"type":"string","description":"Integration key for Duo.","description_kind":"plain","required":true,"sensitive":true},"mount_accessor":{"type":"string","description":"The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the MFA method.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"push_info":{"type":"string","description":"Push information for Duo.","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"Secret key for Duo.","description_kind":"plain","required":true,"sensitive":true},"username_format":{"type":"string","description":"A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_mfa_okta":{"version":0,"block":{"attributes":{"api_token":{"type":"string","description":"Okta API key.","description_kind":"plain","required":true,"sensitive":true},"base_url":{"type":"string","description":"If set, will be used as the base domain for API requests.","description_kind":"plain","optional":true},"id":{"type":"string","description":"ID computed by Vault.","description_kind":"plain","optional":true,"computed":true},"mount_accessor":{"type":"string","description":"The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the MFA method.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"org_name":{"type":"string","description":"Name of the organization to be used in the Okta API.","description_kind":"plain","required":true},"primary_email":{"type":"bool","description":"If set to true, the username will only match the primary email for the account.","description_kind":"plain","optional":true},"username_format":{"type":"string","description":"A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_mfa_pingid":{"version":0,"block":{"attributes":{"admin_url":{"type":"string","description":"Admin URL computed by Vault.","description_kind":"plain","computed":true},"authenticator_url":{"type":"string","description":"Authenticator URL computed by Vault.","description_kind":"plain","computed":true},"id":{"type":"string","description":"ID computed by Vault.","description_kind":"plain","optional":true,"computed":true},"idp_url":{"type":"string","description":"IDP URL computed by Vault.","description_kind":"plain","computed":true},"mount_accessor":{"type":"string","description":"The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the MFA method.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Namespace ID computed by Vault.","description_kind":"plain","computed":true},"org_alias":{"type":"string","description":"Org Alias computed by Vault.","description_kind":"plain","computed":true},"settings_file_base64":{"type":"string","description":"A base64-encoded third-party settings file retrieved from PingID's configuration page.","description_kind":"plain","required":true},"type":{"type":"string","description":"Type of configuration computed by Vault.","description_kind":"plain","computed":true},"use_signature":{"type":"bool","description":"If set, enables use of PingID signature. Computed by Vault","description_kind":"plain","computed":true},"username_format":{"type":"string","description":"A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_mfa_totp":{"version":0,"block":{"attributes":{"algorithm":{"type":"string","description":"Specifies the hashing algorithm used to generate the TOTP code. Options include 'SHA1', 'SHA256' and 'SHA512'.","description_kind":"plain","optional":true},"digits":{"type":"number","description":"The number of digits in the generated TOTP token. This value can either be 6 or 8.","description_kind":"plain","optional":true},"id":{"type":"string","description":"ID computed by Vault.","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"The name of the key's issuing organization.","description_kind":"plain","required":true},"key_size":{"type":"number","description":"Specifies the size in bytes of the generated key.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the MFA method.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"period":{"type":"number","description":"The length of time used to generate a counter for the TOTP token calculation.","description_kind":"plain","optional":true},"qr_size":{"type":"number","description":"The pixel size of the generated square QR code.","description_kind":"plain","optional":true},"skew":{"type":"number","description":"The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_mongodbatlas_secret_backend":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Path where MongoDB Atlas secret backend is mounted","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path where MongoDB Atlas configuration is located","description_kind":"plain","computed":true},"private_key":{"type":"string","description":"The Private Programmatic API Key used to connect with MongoDB Atlas API","description_kind":"plain","required":true},"public_key":{"type":"string","description":"The Public Programmatic API Key used to authenticate with the MongoDB Atlas API","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_mongodbatlas_secret_role":{"version":0,"block":{"attributes":{"cidr_blocks":{"type":["list","string"],"description":"Whitelist entry in CIDR notation to be added for the API key","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_addresses":{"type":["list","string"],"description":"IP address to be added to the whitelist for the API key","description_kind":"plain","optional":true},"max_ttl":{"type":"string","description":"The maximum allowed lifetime of credentials issued using this role","description_kind":"plain","optional":true},"mount":{"type":"string","description":"Path where MongoDB Atlas secret backend is mounted","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the role","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization_id":{"type":"string","description":"ID for the organization to which the target API Key belongs","description_kind":"plain","optional":true},"project_id":{"type":"string","description":"ID for the project to which the target API Key belongs","description_kind":"plain","optional":true},"project_roles":{"type":["list","string"],"description":"Roles assigned when an org API key is assigned to a project API key","description_kind":"plain","optional":true},"roles":{"type":["list","string"],"description":"List of roles that the API Key needs to have","description_kind":"plain","required":true},"ttl":{"type":"string","description":"Duration in seconds after which the issued credential should expire","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_mount":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"Accessor of the mount","description_kind":"plain","computed":true},"allowed_managed_keys":{"type":["set","string"],"description":"List of managed key registry entry names that the mount in question is allowed to access","description_kind":"plain","optional":true},"audit_non_hmac_request_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.","description_kind":"plain","optional":true,"computed":true},"audit_non_hmac_response_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.","description_kind":"plain","optional":true,"computed":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount","description_kind":"plain","optional":true},"external_entropy_access":{"type":"bool","description":"Enable the secrets engine to access Vault's external entropy source","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Local mount flag that can be explicitly set to true to enforce local mount in HA environment","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"Specifies mount type specific options that are passed to the backend","description_kind":"plain","optional":true},"path":{"type":"string","description":"Where the secret backend will be mounted","description_kind":"plain","required":true},"seal_wrap":{"type":"bool","description":"Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability","description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of the backend, such as 'aws'","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_namespace":{"version":0,"block":{"attributes":{"custom_metadata":{"type":["map","string"],"description":"Custom metadata describing this namespace. Value type is map[string]string.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Namespace ID.","description_kind":"plain","computed":true},"path":{"type":"string","description":"Namespace path.","description_kind":"plain","required":true},"path_fq":{"type":"string","description":"The fully qualified namespace path.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_nomad_secret_backend":{"version":1,"block":{"attributes":{"address":{"type":"string","description":"Specifies the address of the Nomad instance, provided as \"protocol://host:port\" like \"http://127.0.0.1:4646\".","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The mount path for the Nomad backend.","description_kind":"plain","optional":true},"ca_cert":{"type":"string","description":"CA certificate to use when verifying Nomad server certificate, must be x509 PEM encoded.","description_kind":"plain","optional":true},"client_cert":{"type":"string","description":"Client certificate used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_key.","description_kind":"plain","optional":true,"sensitive":true},"client_key":{"type":"string","description":"Client key used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert.","description_kind":"plain","optional":true,"sensitive":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds.","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Mark the secrets engine as local-only. Local engines are not replicated or removed by replication. Tolerance duration to use when checking the last rotation time.","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds.","description_kind":"plain","optional":true,"computed":true},"max_token_name_length":{"type":"number","description":"Specifies the maximum length to use for the name of the Nomad token generated with Generate Credential. If omitted, 0 is used and ignored, defaulting to the max value allowed by the Nomad version.","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"Maximum possible lease duration for secrets in seconds.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"token":{"type":"string","description":"Specifies the Nomad Management token to use.","description_kind":"plain","optional":true,"sensitive":true},"ttl":{"type":"number","description":"Maximum possible lease duration for secrets in seconds.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_nomad_secret_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The mount path for the Nomad backend.","description_kind":"plain","required":true},"global":{"type":"bool","description":"Specifies if the token should be global.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["list","string"],"description":"Comma separated list of Nomad policies the token is going to be created against. These need to be created beforehand in Nomad.","description_kind":"plain","optional":true,"computed":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"type":{"type":"string","description":"Specifies the type of token to create when using this role. Valid values are \"client\" or \"management\".","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_okta_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The mount accessor related to the auth mount.","description_kind":"plain","computed":true},"base_url":{"type":"string","description":"The Okta url. Examples: oktapreview.com, okta.com (default)","description_kind":"plain","optional":true},"bypass_okta_mfa":{"type":"bool","description":"When true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.","description_kind":"plain","optional":true},"description":{"type":"string","description":"The description of the auth backend","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"group":{"type":["set",["object",{"group_name":"string","policies":["set","string"]}]],"description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"string","description":"Maximum duration after which authentication will be expired","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"The Okta organization. This will be the first part of the url https://XXX.okta.com.","description_kind":"plain","required":true},"path":{"type":"string","description":"path to mount the backend","description_kind":"plain","optional":true},"token":{"type":"string","description":"The Okta API token. This is required to query Okta for user group membership. If this is not supplied only locally configured groups will be enabled.","description_kind":"plain","optional":true,"sensitive":true},"ttl":{"type":"string","description":"Duration after which authentication will be expired","description_kind":"plain","optional":true},"user":{"type":["set",["object",{"groups":["set","string"],"policies":["set","string"],"username":"string"}]],"description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_okta_auth_backend_group":{"version":0,"block":{"attributes":{"group_name":{"type":"string","description":"Name of the Okta group","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to the Okta auth backend","description_kind":"plain","required":true},"policies":{"type":["set","string"],"description":"Policies to associate with this group","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_okta_auth_backend_user":{"version":0,"block":{"attributes":{"groups":{"type":["set","string"],"description":"Groups within the Okta auth backend to associate with this user","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to the Okta auth backend","description_kind":"plain","required":true},"policies":{"type":["set","string"],"description":"Policies to associate with this user","description_kind":"plain","optional":true},"username":{"type":"string","description":"Name of the user within Okta","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_password_policy":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the password policy.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policy":{"type":"string","description":"The password policy document","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_pki_secret_backend_cert":{"version":0,"block":{"attributes":{"alt_names":{"type":["list","string"],"description":"List of alternative names.","description_kind":"plain","optional":true},"auto_renew":{"type":"bool","description":"If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"ca_chain":{"type":"string","description":"The CA chain.","description_kind":"plain","computed":true},"certificate":{"type":"string","description":"The certicate.","description_kind":"plain","computed":true},"common_name":{"type":"string","description":"CN of the certificate to create.","description_kind":"plain","required":true},"exclude_cn_from_sans":{"type":"bool","description":"Flag to exclude CN from SANs.","description_kind":"plain","optional":true},"expiration":{"type":"number","description":"The certificate expiration as a Unix-style timestamp.","description_kind":"plain","computed":true},"format":{"type":"string","description":"The format of data.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_sans":{"type":["list","string"],"description":"List of alternative IPs.","description_kind":"plain","optional":true},"issuer_ref":{"type":"string","description":"Specifies the default issuer of this request.","description_kind":"plain","optional":true},"issuing_ca":{"type":"string","description":"The issuing CA.","description_kind":"plain","computed":true},"min_seconds_remaining":{"type":"number","description":"Generate a new certificate when the expiration is within this number of seconds","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the role to create the certificate against.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"other_sans":{"type":["list","string"],"description":"List of other SANs.","description_kind":"plain","optional":true},"private_key":{"type":"string","description":"The private key.","description_kind":"plain","computed":true,"sensitive":true},"private_key_format":{"type":"string","description":"The private key format.","description_kind":"plain","optional":true},"private_key_type":{"type":"string","description":"The private key type.","description_kind":"plain","computed":true},"renew_pending":{"type":"bool","description":"Initially false, and then set to true during refresh once the expiration is less than min_seconds_remaining in the future.","description_kind":"plain","computed":true},"revoke":{"type":"bool","description":"Revoke the certificate upon resource destruction.","description_kind":"plain","optional":true},"serial_number":{"type":"string","description":"The serial number.","description_kind":"plain","computed":true},"ttl":{"type":"string","description":"Time to live.","description_kind":"plain","optional":true},"uri_sans":{"type":["list","string"],"description":"List of alternative URIs.","description_kind":"plain","optional":true},"user_ids":{"type":["list","string"],"description":"List of Subject User IDs.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_config_ca":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"pem_bundle":{"type":"string","description":"The key and certificate PEM bundle.","description_kind":"plain","required":true,"sensitive":true}},"description_kind":"plain"}},"vault_pki_secret_backend_config_cluster":{"version":0,"block":{"attributes":{"aia_path":{"type":"string","description":"Path to the cluster's AIA distribution point.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to the cluster's API mount path.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_config_issuers":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"default":{"type":"string","description":"Specifies the default issuer by ID.","description_kind":"plain","optional":true},"default_follows_latest_issuer":{"type":"bool","description":"Specifies whether a root creation or an issuer import operation updates the default issuer to the newly added issuer.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_config_urls":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"crl_distribution_points":{"type":["list","string"],"description":"Specifies the URL values for the CRL Distribution Points field.","description_kind":"plain","optional":true},"enable_templating":{"type":"bool","description":"Specifies that templating of AIA fields is allowed.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuing_certificates":{"type":["list","string"],"description":"Specifies the URL values for the Issuing Certificate field.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"ocsp_servers":{"type":["list","string"],"description":"Specifies the URL values for the OCSP Servers field.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_crl_config":{"version":0,"block":{"attributes":{"auto_rebuild":{"type":"bool","description":"Enables or disables periodic rebuilding of the CRL upon expiry.","description_kind":"plain","optional":true},"auto_rebuild_grace_period":{"type":"string","description":"Grace period before CRL expiry to attempt rebuild of CRL.","description_kind":"plain","optional":true,"computed":true},"backend":{"type":"string","description":"The path of the PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"cross_cluster_revocation":{"type":"bool","description":"Enable cross-cluster revocation request queues.","description_kind":"plain","optional":true,"computed":true},"delta_rebuild_interval":{"type":"string","description":"Interval to check for new revocations on, to regenerate the delta CRL.","description_kind":"plain","optional":true,"computed":true},"disable":{"type":"bool","description":"Disables or enables CRL building","description_kind":"plain","optional":true},"enable_delta":{"type":"bool","description":"Enables or disables building of delta CRLs with up-to-date revocation information, augmenting the last complete CRL.","description_kind":"plain","optional":true},"expiry":{"type":"string","description":"Specifies the time until expiration.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"ocsp_disable":{"type":"bool","description":"Disables or enables the OCSP responder in Vault.","description_kind":"plain","optional":true},"ocsp_expiry":{"type":"string","description":"The amount of time an OCSP response can be cached for, useful for OCSP stapling refresh durations.","description_kind":"plain","optional":true,"computed":true},"unified_crl":{"type":"bool","description":"Enables unified CRL and OCSP building.","description_kind":"plain","optional":true,"computed":true},"unified_crl_on_existing_paths":{"type":"bool","description":"Enables serving the unified CRL and OCSP on the existing, previously cluster-local paths.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_pki_secret_backend_intermediate_cert_request":{"version":0,"block":{"attributes":{"add_basic_constraints":{"type":"bool","description":"Set 'CA: true' in a Basic Constraints extension. Only needed as\na workaround in some compatibility scenarios with Active Directory Certificate Services.","description_kind":"plain","optional":true},"alt_names":{"type":["list","string"],"description":"List of alternative names.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"common_name":{"type":"string","description":"CN of intermediate to create.","description_kind":"plain","required":true},"country":{"type":"string","description":"The country.","description_kind":"plain","optional":true},"csr":{"type":"string","description":"The CSR.","description_kind":"plain","computed":true},"exclude_cn_from_sans":{"type":"bool","description":"Flag to exclude CN from SANs.","description_kind":"plain","optional":true},"format":{"type":"string","description":"The format of data.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_sans":{"type":["list","string"],"description":"List of alternative IPs.","description_kind":"plain","optional":true},"key_bits":{"type":"number","description":"The number of bits to use.","description_kind":"plain","optional":true},"key_id":{"type":"string","description":"The ID of the generated key.","description_kind":"plain","computed":true},"key_name":{"type":"string","description":"When a new key is created with this request, optionally specifies the name for this.","description_kind":"plain","optional":true,"computed":true},"key_ref":{"type":"string","description":"Specifies the key to use for generating this request.","description_kind":"plain","optional":true,"computed":true},"key_type":{"type":"string","description":"The desired key type.","description_kind":"plain","optional":true},"locality":{"type":"string","description":"The locality.","description_kind":"plain","optional":true},"managed_key_id":{"type":"string","description":"The ID of the previously configured managed key.","description_kind":"plain","optional":true},"managed_key_name":{"type":"string","description":"The name of the previously configured managed key.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"The organization.","description_kind":"plain","optional":true},"other_sans":{"type":["list","string"],"description":"List of other SANs.","description_kind":"plain","optional":true},"ou":{"type":"string","description":"The organization unit.","description_kind":"plain","optional":true},"postal_code":{"type":"string","description":"The postal code.","description_kind":"plain","optional":true},"private_key":{"type":"string","description":"The private key.","description_kind":"plain","computed":true,"sensitive":true},"private_key_format":{"type":"string","description":"The private key format.","description_kind":"plain","optional":true},"private_key_type":{"type":"string","description":"The private key type.","description_kind":"plain","computed":true},"province":{"type":"string","description":"The province.","description_kind":"plain","optional":true},"street_address":{"type":"string","description":"The street address.","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of intermediate to create. Must be either \"existing\", \"exported\", \"internal\" or \"kms\"","description_kind":"plain","required":true},"uri_sans":{"type":["list","string"],"description":"List of alternative URIs.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_intermediate_set_signed":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"certificate":{"type":"string","description":"The certificate.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"imported_issuers":{"type":["list","string"],"description":"The imported issuers.","description_kind":"plain","computed":true},"imported_keys":{"type":["list","string"],"description":"The imported keys.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_issuer":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"crl_distribution_points":{"type":["list","string"],"description":"Specifies the URL values for the CRL Distribution Points field.","description_kind":"plain","optional":true},"enable_aia_url_templating":{"type":"bool","description":"Specifies that the AIA URL values should be templated.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer_id":{"type":"string","description":"ID of the issuer.","description_kind":"plain","computed":true},"issuer_name":{"type":"string","description":"Reference to an existing issuer.","description_kind":"plain","optional":true},"issuer_ref":{"type":"string","description":"Reference to an existing issuer.","description_kind":"plain","required":true},"issuing_certificates":{"type":["list","string"],"description":"Specifies the URL values for the Issuing Certificate field.","description_kind":"plain","optional":true},"leaf_not_after_behavior":{"type":"string","description":"Behavior of a leaf's 'NotAfter' field during issuance.","description_kind":"plain","optional":true,"computed":true},"manual_chain":{"type":["list","string"],"description":"Chain of issuer references to build this issuer's computed CAChain field from, when non-empty.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"ocsp_servers":{"type":["list","string"],"description":"Specifies the URL values for the OCSP Servers field.","description_kind":"plain","optional":true},"revocation_signature_algorithm":{"type":"string","description":"Which signature algorithm to use when building CRLs.","description_kind":"plain","optional":true,"computed":true},"usage":{"type":"string","description":"Comma-separated list of allowed usages for this issuer.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_pki_secret_backend_key":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_bits":{"type":"number","description":"Specifies the number of bits to use for the generated keys.","description_kind":"plain","optional":true,"computed":true},"key_id":{"type":"string","description":"ID of the generated key.","description_kind":"plain","computed":true},"key_name":{"type":"string","description":"When a new key is created with this request, optionally specifies the name for this.","description_kind":"plain","optional":true},"key_type":{"type":"string","description":"Specifies the desired key type; must be 'rsa', 'ed25519' or 'ec'.","description_kind":"plain","optional":true,"computed":true},"managed_key_id":{"type":"string","description":"The managed key's UUID.","description_kind":"plain","optional":true},"managed_key_name":{"type":"string","description":"The managed key's configured name.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"type":{"type":"string","description":"Specifies the type of the key to create.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_pki_secret_backend_role":{"version":0,"block":{"attributes":{"allow_any_name":{"type":"bool","description":"Flag to allow any name","description_kind":"plain","optional":true},"allow_bare_domains":{"type":"bool","description":"Flag to allow certificates matching the actual domain.","description_kind":"plain","optional":true},"allow_glob_domains":{"type":"bool","description":"Flag to allow names containing glob patterns.","description_kind":"plain","optional":true},"allow_ip_sans":{"type":"bool","description":"Flag to allow IP SANs","description_kind":"plain","optional":true},"allow_localhost":{"type":"bool","description":"Flag to allow certificates for localhost.","description_kind":"plain","optional":true},"allow_subdomains":{"type":"bool","description":"Flag to allow certificates matching subdomains.","description_kind":"plain","optional":true},"allow_wildcard_certificates":{"type":"bool","description":"Flag to allow wildcard certificates","description_kind":"plain","optional":true},"allowed_domains":{"type":["list","string"],"description":"The domains of the role.","description_kind":"plain","optional":true},"allowed_domains_template":{"type":"bool","description":"Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.\u003cmount accessor\u003e.name}})","description_kind":"plain","optional":true},"allowed_other_sans":{"type":["list","string"],"description":"Defines allowed custom SANs","description_kind":"plain","optional":true},"allowed_serial_numbers":{"type":["list","string"],"description":"Defines allowed Subject serial numbers.","description_kind":"plain","optional":true},"allowed_uri_sans":{"type":["list","string"],"description":"Defines allowed URI SANs","description_kind":"plain","optional":true},"allowed_uri_sans_template":{"type":"bool","description":"Flag to indicate that `allowed_uri_sans` specifies a template expression (e.g. {{identity.entity.aliases.\u003cmount accessor\u003e.name}})","description_kind":"plain","optional":true,"computed":true},"allowed_user_ids":{"type":["list","string"],"description":"The allowed User ID's.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The path of the PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"basic_constraints_valid_for_non_ca":{"type":"bool","description":"Flag to mark basic constraints valid when issuing non-CA certificates.","description_kind":"plain","optional":true},"client_flag":{"type":"bool","description":"Flag to specify certificates for client use.","description_kind":"plain","optional":true},"code_signing_flag":{"type":"bool","description":"Flag to specify certificates for code signing use.","description_kind":"plain","optional":true},"country":{"type":["list","string"],"description":"The country of generated certificates.","description_kind":"plain","optional":true},"email_protection_flag":{"type":"bool","description":"Flag to specify certificates for email protection use.","description_kind":"plain","optional":true},"enforce_hostnames":{"type":"bool","description":"Flag to allow only valid host names","description_kind":"plain","optional":true},"ext_key_usage":{"type":["list","string"],"description":"Specify the allowed extended key usage constraint on issued certificates.","description_kind":"plain","optional":true},"ext_key_usage_oids":{"type":["list","string"],"description":"A list of extended key usage OIDs.","description_kind":"plain","optional":true},"generate_lease":{"type":"bool","description":"Flag to generate leases with certificates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer_ref":{"type":"string","description":"Specifies the default issuer of this request.","description_kind":"plain","optional":true,"computed":true},"key_bits":{"type":"number","description":"The number of bits of generated keys.","description_kind":"plain","optional":true},"key_type":{"type":"string","description":"The generated key type.","description_kind":"plain","optional":true},"key_usage":{"type":["list","string"],"description":"Specify the allowed key usage constraint on issued certificates.","description_kind":"plain","optional":true,"computed":true},"locality":{"type":["list","string"],"description":"The locality of generated certificates.","description_kind":"plain","optional":true},"max_ttl":{"type":"string","description":"The maximum TTL.","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name for the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"no_store":{"type":"bool","description":"Flag to not store certificates in the storage backend.","description_kind":"plain","optional":true},"not_before_duration":{"type":"string","description":"Specifies the duration by which to backdate the NotBefore property.","description_kind":"plain","optional":true,"computed":true},"organization":{"type":["list","string"],"description":"The organization of generated certificates.","description_kind":"plain","optional":true},"ou":{"type":["list","string"],"description":"The organization unit of generated certificates.","description_kind":"plain","optional":true},"policy_identifiers":{"type":["list","string"],"description":"Specify the list of allowed policies OIDs.","description_kind":"plain","optional":true},"postal_code":{"type":["list","string"],"description":"The postal code of generated certificates.","description_kind":"plain","optional":true},"province":{"type":["list","string"],"description":"The province of generated certificates.","description_kind":"plain","optional":true},"require_cn":{"type":"bool","description":"Flag to force CN usage.","description_kind":"plain","optional":true},"server_flag":{"type":"bool","description":"Flag to specify certificates for server use.","description_kind":"plain","optional":true},"street_address":{"type":["list","string"],"description":"The street address of generated certificates.","description_kind":"plain","optional":true},"ttl":{"type":"string","description":"The TTL.","description_kind":"plain","optional":true,"computed":true},"use_csr_common_name":{"type":"bool","description":"Flag to use the CN in the CSR.","description_kind":"plain","optional":true},"use_csr_sans":{"type":"bool","description":"Flag to use the SANs in the CSR.","description_kind":"plain","optional":true}},"block_types":{"policy_identifier":{"nesting_mode":"set","block":{"attributes":{"cps":{"type":"string","description":"Optional CPS URL","description_kind":"plain","optional":true},"notice":{"type":"string","description":"Optional notice","description_kind":"plain","optional":true},"oid":{"type":"string","description":"OID","description_kind":"plain","required":true}},"description":"Policy identifier block; can only be used with Vault 1.11+","description_kind":"plain"}}},"description_kind":"plain"}},"vault_pki_secret_backend_root_cert":{"version":1,"block":{"attributes":{"alt_names":{"type":["list","string"],"description":"List of alternative names.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"certificate":{"type":"string","description":"The certificate.","description_kind":"plain","computed":true},"common_name":{"type":"string","description":"CN of root to create.","description_kind":"plain","required":true},"country":{"type":"string","description":"The country.","description_kind":"plain","optional":true},"exclude_cn_from_sans":{"type":"bool","description":"Flag to exclude CN from SANs.","description_kind":"plain","optional":true},"format":{"type":"string","description":"The format of data.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_sans":{"type":["list","string"],"description":"List of alternative IPs.","description_kind":"plain","optional":true},"issuer_id":{"type":"string","description":"The ID of the generated issuer.","description_kind":"plain","computed":true},"issuer_name":{"type":"string","description":"Provides a name to the specified issuer. The name must be unique across all issuers and not be the reserved value 'default'.","description_kind":"plain","optional":true,"computed":true},"issuing_ca":{"type":"string","description":"The issuing CA.","description_kind":"plain","computed":true},"key_bits":{"type":"number","description":"The number of bits to use.","description_kind":"plain","optional":true},"key_id":{"type":"string","description":"The ID of the generated key.","description_kind":"plain","computed":true},"key_name":{"type":"string","description":"When a new key is created with this request, optionally specifies the name for this.","description_kind":"plain","optional":true,"computed":true},"key_ref":{"type":"string","description":"Specifies the key to use for generating this request.","description_kind":"plain","optional":true,"computed":true},"key_type":{"type":"string","description":"The desired key type.","description_kind":"plain","optional":true},"locality":{"type":"string","description":"The locality.","description_kind":"plain","optional":true},"managed_key_id":{"type":"string","description":"The ID of the previously configured managed key.","description_kind":"plain","optional":true,"computed":true},"managed_key_name":{"type":"string","description":"The name of the previously configured managed key.","description_kind":"plain","optional":true,"computed":true},"max_path_length":{"type":"number","description":"The maximum path length to encode in the generated certificate.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"The organization.","description_kind":"plain","optional":true},"other_sans":{"type":["list","string"],"description":"List of other SANs.","description_kind":"plain","optional":true},"ou":{"type":"string","description":"The organization unit.","description_kind":"plain","optional":true},"permitted_dns_domains":{"type":["list","string"],"description":"List of domains for which certificates are allowed to be issued.","description_kind":"plain","optional":true},"postal_code":{"type":"string","description":"The postal code.","description_kind":"plain","optional":true},"private_key_format":{"type":"string","description":"The private key format.","description_kind":"plain","optional":true},"province":{"type":"string","description":"The province.","description_kind":"plain","optional":true},"serial_number":{"type":"string","description":"The certificate's serial number, hex formatted.","description_kind":"plain","computed":true},"street_address":{"type":"string","description":"The street address.","description_kind":"plain","optional":true},"ttl":{"type":"string","description":"Time to live.","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of root to create. Must be either \"existing\", \"exported\", \"internal\" or \"kms\"","description_kind":"plain","required":true},"uri_sans":{"type":["list","string"],"description":"List of alternative URIs.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_root_sign_intermediate":{"version":2,"block":{"attributes":{"alt_names":{"type":["list","string"],"description":"List of alternative names.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"ca_chain":{"type":["list","string"],"description":"The CA chain as a list of format specific certificates","description_kind":"plain","computed":true},"certificate":{"type":"string","description":"The signed intermediate CA certificate.","description_kind":"plain","computed":true},"certificate_bundle":{"type":"string","description":"The concatenation of the intermediate and issuing CA certificates (PEM encoded). Requires the format to be set to any of: pem, pem_bundle. The value will be empty for all other formats.","description_kind":"plain","computed":true},"common_name":{"type":"string","description":"CN of intermediate to create.","description_kind":"plain","required":true},"country":{"type":"string","description":"The country.","description_kind":"plain","optional":true},"csr":{"type":"string","description":"The CSR.","description_kind":"plain","required":true},"exclude_cn_from_sans":{"type":"bool","description":"Flag to exclude CN from SANs.","description_kind":"plain","optional":true},"format":{"type":"string","description":"The format of data.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_sans":{"type":["list","string"],"description":"List of alternative IPs.","description_kind":"plain","optional":true},"issuer_ref":{"type":"string","description":"Specifies the default issuer of this request.","description_kind":"plain","optional":true},"issuing_ca":{"type":"string","description":"The issuing CA certificate.","description_kind":"plain","computed":true},"locality":{"type":"string","description":"The locality.","description_kind":"plain","optional":true},"max_path_length":{"type":"number","description":"The maximum path length to encode in the generated certificate.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"The organization.","description_kind":"plain","optional":true},"other_sans":{"type":["list","string"],"description":"List of other SANs.","description_kind":"plain","optional":true},"ou":{"type":"string","description":"The organization unit.","description_kind":"plain","optional":true},"permitted_dns_domains":{"type":["list","string"],"description":"List of domains for which certificates are allowed to be issued.","description_kind":"plain","optional":true},"postal_code":{"type":"string","description":"The postal code.","description_kind":"plain","optional":true},"province":{"type":"string","description":"The province.","description_kind":"plain","optional":true},"revoke":{"type":"bool","description":"Revoke the certificate upon resource destruction.","description_kind":"plain","optional":true},"serial_number":{"type":"string","description":"The certificate's serial number, hex formatted.","description_kind":"plain","computed":true},"street_address":{"type":"string","description":"The street address.","description_kind":"plain","optional":true},"ttl":{"type":"string","description":"Time to live.","description_kind":"plain","optional":true},"uri_sans":{"type":["list","string"],"description":"List of alternative URIs.","description_kind":"plain","optional":true},"use_csr_values":{"type":"bool","description":"Preserve CSR values.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_sign":{"version":1,"block":{"attributes":{"alt_names":{"type":["list","string"],"description":"List of alternative names.","description_kind":"plain","optional":true},"auto_renew":{"type":"bool","description":"If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"ca_chain":{"type":["list","string"],"description":"The CA chain.","description_kind":"plain","computed":true},"certificate":{"type":"string","description":"The certicate.","description_kind":"plain","computed":true},"common_name":{"type":"string","description":"CN of intermediate to create.","description_kind":"plain","required":true},"csr":{"type":"string","description":"The CSR.","description_kind":"plain","required":true},"exclude_cn_from_sans":{"type":"bool","description":"Flag to exclude CN from SANs.","description_kind":"plain","optional":true},"expiration":{"type":"number","description":"The certificate expiration as a Unix-style timestamp.","description_kind":"plain","computed":true},"format":{"type":"string","description":"The format of data.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_sans":{"type":["list","string"],"description":"List of alternative IPs.","description_kind":"plain","optional":true},"issuer_ref":{"type":"string","description":"Specifies the default issuer of this request.","description_kind":"plain","optional":true},"issuing_ca":{"type":"string","description":"The issuing CA.","description_kind":"plain","computed":true},"min_seconds_remaining":{"type":"number","description":"Generate a new certificate when the expiration is within this number of seconds","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the role to create the certificate against.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"other_sans":{"type":["list","string"],"description":"List of other SANs.","description_kind":"plain","optional":true},"renew_pending":{"type":"bool","description":"Initially false, and then set to true during refresh once the expiration is less than min_seconds_remaining in the future.","description_kind":"plain","computed":true},"serial_number":{"type":"string","description":"The certificate's serial number, hex formatted.","description_kind":"plain","computed":true},"ttl":{"type":"string","description":"Time to live.","description_kind":"plain","optional":true},"uri_sans":{"type":["list","string"],"description":"List of alternative URIs.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_policy":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the policy","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policy":{"type":"string","description":"The policy document","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_quota_lease_count":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_leases":{"type":"number","description":"The maximum number of leases to be allowed by the quota rule. The max_leases must be positive.","description_kind":"plain","required":true},"name":{"type":"string","description":"The name of the quota.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path of the mount or namespace to apply the quota. A blank path configures a global lease count quota.","description_kind":"plain","optional":true},"role":{"type":"string","description":"If set on a quota where path is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_quota_rate_limit":{"version":0,"block":{"attributes":{"block_interval":{"type":"number","description":"If set, when a client reaches a rate limit threshold, the client will be prohibited from any further requests until after the 'block_interval' in seconds has elapsed.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"interval":{"type":"number","description":"The duration in seconds to enforce rate limiting for.","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the quota.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path of the mount or namespace to apply the quota. A blank path configures a global rate limit quota.","description_kind":"plain","optional":true},"rate":{"type":"number","description":"The maximum number of requests at any given second to be allowed by the quota rule. The rate must be positive.","description_kind":"plain","required":true},"role":{"type":"string","description":"If set on a quota where path is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_rabbitmq_secret_backend":{"version":1,"block":{"attributes":{"connection_uri":{"type":"string","description":"Specifies the RabbitMQ connection URI.","description_kind":"plain","required":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"password":{"type":"string","description":"Specifies the RabbitMQ management administrator password","description_kind":"plain","required":true,"sensitive":true},"password_policy":{"type":"string","description":"Specifies a password policy to use when creating dynamic credentials. Defaults to generating an alphanumeric password if not set.","description_kind":"plain","optional":true},"path":{"type":"string","description":"The path of the RabbitMQ Secret Backend where the connection should be configured","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the RabbitMQ management administrator username","description_kind":"plain","required":true,"sensitive":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies whether to verify connection URI, username, and password.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_rabbitmq_secret_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the Rabbitmq Secret Backend the role belongs to.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name for the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"tags":{"type":"string","description":"Specifies a comma-separated RabbitMQ management tags.","description_kind":"plain","optional":true}},"block_types":{"vhost":{"nesting_mode":"list","block":{"attributes":{"configure":{"type":"string","description":"The configure permissions for this vhost.","description_kind":"plain","required":true},"host":{"type":"string","description":"The vhost to set permissions for.","description_kind":"plain","required":true},"read":{"type":"string","description":"The read permissions for this vhost.","description_kind":"plain","required":true},"write":{"type":"string","description":"The write permissions for this vhost.","description_kind":"plain","required":true}},"description":"Specifies a map of virtual hosts to permissions.","description_kind":"plain"}},"vhost_topic":{"nesting_mode":"list","block":{"attributes":{"host":{"type":"string","description":"The vhost to set permissions for.","description_kind":"plain","required":true}},"block_types":{"vhost":{"nesting_mode":"list","block":{"attributes":{"read":{"type":"string","description":"The read permissions for this vhost.","description_kind":"plain","required":true},"topic":{"type":"string","description":"The vhost to set permissions for.","description_kind":"plain","required":true},"write":{"type":"string","description":"The write permissions for this vhost.","description_kind":"plain","required":true}},"description":"Specifies a map of virtual hosts to permissions.","description_kind":"plain"}}},"description":"Specifies a map of virtual hosts and exchanges to topic permissions. This option requires RabbitMQ 3.7.0 or later.","description_kind":"plain"}}},"description_kind":"plain"}},"vault_raft_autopilot":{"version":0,"block":{"attributes":{"cleanup_dead_servers":{"type":"bool","description":"Specifies whether to remove dead server nodes periodically or when a new server joins. This requires that min-quorum is also set.","description_kind":"plain","optional":true},"dead_server_last_contact_threshold":{"type":"string","description":"Limit the amount of time a server can go without leader contact before being considered failed. This only takes effect when cleanup_dead_servers is set.","description_kind":"plain","optional":true},"disable_upgrade_migration":{"type":"bool","description":"Disables automatically upgrading Vault using autopilot. (Enterprise-only)","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"last_contact_threshold":{"type":"string","description":"Limit the amount of time a server can go without leader contact before being considered unhealthy.","description_kind":"plain","optional":true},"max_trailing_logs":{"type":"number","description":"Maximum number of log entries in the Raft log that a server can be behind its leader before being considered unhealthy.","description_kind":"plain","optional":true},"min_quorum":{"type":"number","description":"Minimum number of servers allowed in a cluster before autopilot can prune dead servers. This should at least be 3. Applicable only for voting nodes.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"server_stabilization_time":{"type":"string","description":"Minimum amount of time a server must be stable in the 'healthy' state before being added to the cluster.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_raft_snapshot_agent_config":{"version":0,"block":{"attributes":{"aws_access_key_id":{"type":"string","description":"AWS access key ID.","description_kind":"plain","optional":true},"aws_s3_bucket":{"type":"string","description":"S3 bucket to write snapshots to.","description_kind":"plain","optional":true},"aws_s3_disable_tls":{"type":"bool","description":"Disable TLS for the S3 endpoint. This should only be used for testing purposes.","description_kind":"plain","optional":true},"aws_s3_enable_kms":{"type":"bool","description":"Use KMS to encrypt bucket contents.","description_kind":"plain","optional":true},"aws_s3_endpoint":{"type":"string","description":"AWS endpoint. This is typically only set when using a non-AWS S3 implementation like Minio.","description_kind":"plain","optional":true},"aws_s3_force_path_style":{"type":"bool","description":"Use the endpoint/bucket URL style instead of bucket.endpoint.","description_kind":"plain","optional":true},"aws_s3_kms_key":{"type":"string","description":"Use named KMS key, when aws_s3_enable_kms=true","description_kind":"plain","optional":true},"aws_s3_region":{"type":"string","description":"AWS region bucket is in.","description_kind":"plain","optional":true},"aws_s3_server_side_encryption":{"type":"bool","description":"Use AES256 to encrypt bucket contents.","description_kind":"plain","optional":true},"aws_secret_access_key":{"type":"string","description":"AWS secret access key.","description_kind":"plain","optional":true},"aws_session_token":{"type":"string","description":"AWS session token.","description_kind":"plain","optional":true},"azure_account_key":{"type":"string","description":"Azure account key.","description_kind":"plain","optional":true},"azure_account_name":{"type":"string","description":"Azure account name.","description_kind":"plain","optional":true},"azure_blob_environment":{"type":"string","description":"Azure blob environment.","description_kind":"plain","optional":true},"azure_container_name":{"type":"string","description":"Azure container name to write snapshots to.","description_kind":"plain","optional":true},"azure_endpoint":{"type":"string","description":"Azure blob storage endpoint. This is typically only set when using a non-Azure implementation like Azurite.","description_kind":"plain","optional":true},"file_prefix":{"type":"string","description":"The file or object name of snapshot files will start with this string.","description_kind":"plain","optional":true},"google_disable_tls":{"type":"bool","description":"Disable TLS for the GCS endpoint.","description_kind":"plain","optional":true},"google_endpoint":{"type":"string","description":"GCS endpoint. This is typically only set when using a non-Google GCS implementation like fake-gcs-server.","description_kind":"plain","optional":true},"google_gcs_bucket":{"type":"string","description":"GCS bucket to write snapshots to.","description_kind":"plain","optional":true},"google_service_account_key":{"type":"string","description":"Google service account key in JSON format.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"interval_seconds":{"type":"number","description":"Number of seconds between snapshots.","description_kind":"plain","required":true},"local_max_space":{"type":"number","description":"The maximum space, in bytes, to use for snapshots.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the snapshot agent configuration.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path_prefix":{"type":"string","description":"The directory or bucket prefix to to use.","description_kind":"plain","required":true},"retain":{"type":"number","description":"How many snapshots are to be kept.","description_kind":"plain","optional":true},"storage_type":{"type":"string","description":"What storage service to send snapshots to. One of \"local\", \"azure-blob\", \"aws-s3\", or \"google-gcs\".","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_rgp_policy":{"version":0,"block":{"attributes":{"enforcement_level":{"type":"string","description":"Enforcement level of Sentinel policy. Can be one of: 'advisory', 'soft-mandatory' or 'hard-mandatory'","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the policy","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policy":{"type":"string","description":"The policy document","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_saml_auth_backend":{"version":0,"block":{"attributes":{"acs_urls":{"type":["list","string"],"description":"The well-formatted URLs of your Assertion Consumer Service (ACS) that should receive a response from the identity provider.","description_kind":"plain","required":true},"default_role":{"type":"string","description":"The role to use if no role is provided during login.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"entity_id":{"type":"string","description":"The entity ID of the SAML authentication service provider.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"idp_cert":{"type":"string","description":"The PEM encoded certificate of the identity provider. Mutually exclusive with 'idp_metadata_url'","description_kind":"plain","optional":true},"idp_entity_id":{"type":"string","description":"The entity ID of the identity provider. Mutually exclusive with 'idp_metadata_url'.","description_kind":"plain","optional":true},"idp_metadata_url":{"type":"string","description":"The metadata URL of the identity provider.","description_kind":"plain","optional":true},"idp_sso_url":{"type":"string","description":"The SSO URL of the identity provider. Mutually exclusive with 'idp_metadata_url'.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"verbose_logging":{"type":"bool","description":"Log additional, potentially sensitive information during the SAML exchange according to the current logging level. Not recommended for production.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_saml_auth_backend_role":{"version":0,"block":{"attributes":{"bound_attributes":{"type":["map","string"],"description":"Mapping of attribute names to values that are expected to exist in the SAML assertion.","description_kind":"plain","optional":true},"bound_attributes_type":{"type":"string","description":"The type of matching assertion to perform on bound_attributes.","description_kind":"plain","optional":true,"computed":true},"bound_subjects":{"type":["list","string"],"description":"The subject being asserted for SAML authentication.","description_kind":"plain","optional":true},"bound_subjects_type":{"type":"string","description":"The type of matching assertion to perform on bound_subjects.","description_kind":"plain","optional":true,"computed":true},"groups_attribute":{"type":"string","description":"The attribute to use to identify the set of groups to which the user belongs.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name of the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path where SAML Auth engine is mounted.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_secrets_sync_association":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"metadata":{"type":["list",["object",{"sub_key":"string","sync_status":"string","updated_at":"string"}]],"description":"Metadata for each subkey of the associated secret.","description_kind":"plain","computed":true},"mount":{"type":"string","description":"Specifies the mount where the secret is located.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_name":{"type":"string","description":"Specifies the name of the secret to synchronize.","description_kind":"plain","required":true},"type":{"type":"string","description":"Type of sync destination.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_secrets_sync_aws_destination":{"version":0,"block":{"attributes":{"access_key_id":{"type":"string","description":"Access key id to authenticate against the AWS secrets manager.","description_kind":"plain","optional":true},"custom_tags":{"type":["map","string"],"description":"Custom tags to set on the secret managed at the destination.","description_kind":"plain","optional":true},"external_id":{"type":"string","description":"Extra protection that must match the trust policy granting access to the AWS IAM role ARN.","description_kind":"plain","optional":true},"granularity":{"type":"string","description":"Determines what level of information is synced as a distinct resource at the destination. Can be 'secret-path' or 'secret-key'","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name of the AWS destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"region":{"type":"string","description":"Region where to manage the secrets manager entries.","description_kind":"plain","optional":true},"role_arn":{"type":"string","description":"Specifies a role to assume when connecting to AWS.","description_kind":"plain","optional":true},"secret_access_key":{"type":"string","description":"Secret access key to authenticate against the AWS secrets manager.","description_kind":"plain","optional":true,"sensitive":true},"secret_name_template":{"type":"string","description":"Template describing how to generate external secret names.","description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of secrets destination.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_secrets_sync_azure_destination":{"version":0,"block":{"attributes":{"client_id":{"type":"string","description":"Client ID of an Azure app registration.","description_kind":"plain","optional":true},"client_secret":{"type":"string","description":"Client Secret of an Azure app registration.","description_kind":"plain","optional":true,"sensitive":true},"cloud":{"type":"string","description":"Specifies a cloud for the client.","description_kind":"plain","optional":true},"custom_tags":{"type":["map","string"],"description":"Custom tags to set on the secret managed at the destination.","description_kind":"plain","optional":true},"granularity":{"type":"string","description":"Determines what level of information is synced as a distinct resource at the destination. Can be 'secret-path' or 'secret-key'","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_vault_uri":{"type":"string","description":"URI of an existing Azure Key Vault instance.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Unique name of the Azure destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_name_template":{"type":"string","description":"Template describing how to generate external secret names.","description_kind":"plain","optional":true,"computed":true},"tenant_id":{"type":"string","description":"ID of the target Azure tenant.","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of secrets destination.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_secrets_sync_config":{"version":0,"block":{"attributes":{"disabled":{"type":"bool","description":"Disables the syncing process between Vault and external destinations.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"queue_capacity":{"type":"number","description":"Maximum number of pending sync operations allowed on the queue.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_secrets_sync_gcp_destination":{"version":0,"block":{"attributes":{"credentials":{"type":"string","description":"JSON-encoded credentials to use to connect to GCP.","description_kind":"plain","optional":true,"sensitive":true},"custom_tags":{"type":["map","string"],"description":"Custom tags to set on the secret managed at the destination.","description_kind":"plain","optional":true},"granularity":{"type":"string","description":"Determines what level of information is synced as a distinct resource at the destination. Can be 'secret-path' or 'secret-key'","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name of the GCP destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"project_id":{"type":"string","description":"The target project to manage secrets in.","description_kind":"plain","optional":true},"secret_name_template":{"type":"string","description":"Template describing how to generate external secret names.","description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of secrets destination.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_secrets_sync_gh_destination":{"version":0,"block":{"attributes":{"access_token":{"type":"string","description":"Fine-grained or personal access token.","description_kind":"plain","optional":true,"sensitive":true},"app_name":{"type":"string","description":"The user-defined name of the GitHub App configuration.","description_kind":"plain","optional":true},"granularity":{"type":"string","description":"Determines what level of information is synced as a distinct resource at the destination. Can be 'secret-path' or 'secret-key'","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"installation_id":{"type":"number","description":"The ID of the installation generated by GitHub when the app referenced by the app_name was installed in the user’s GitHub account. Necessary if the app_name field is also provided.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Unique name of the github destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"repository_name":{"type":"string","description":"Name of the repository.","description_kind":"plain","optional":true},"repository_owner":{"type":"string","description":"GitHub organization or username that owns the repository.","description_kind":"plain","optional":true},"secret_name_template":{"type":"string","description":"Template describing how to generate external secret names.","description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of secrets destination.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_secrets_sync_github_apps":{"version":0,"block":{"attributes":{"app_id":{"type":"number","description":"The GitHub application ID.","description_kind":"plain","required":true},"fingerprint":{"type":"string","description":"A fingerprint of a private key.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The user-defined name of the GitHub App configuration.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"private_key":{"type":"string","description":"The content of a PEM formatted private key generated on GitHub for the app.","description_kind":"plain","required":true,"sensitive":true}},"description_kind":"plain"}},"vault_secrets_sync_vercel_destination":{"version":0,"block":{"attributes":{"access_token":{"type":"string","description":"Vercel API access token with the permissions to manage environment variables.","description_kind":"plain","required":true,"sensitive":true},"deployment_environments":{"type":["list","string"],"description":"Deployment environments where the environment variables are available. Accepts 'development', 'preview' \u0026 'production'.","description_kind":"plain","required":true},"granularity":{"type":"string","description":"Determines what level of information is synced as a distinct resource at the destination. Can be 'secret-path' or 'secret-key'","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name of the Vercel destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"project_id":{"type":"string","description":"Project ID where to manage environment variables.","description_kind":"plain","required":true},"secret_name_template":{"type":"string","description":"Template describing how to generate external secret names.","description_kind":"plain","optional":true,"computed":true},"team_id":{"type":"string","description":"Team ID the project belongs to.","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of secrets destination.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_ssh_secret_backend_ca":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the SSH Secret Backend where the CA should be configured","description_kind":"plain","optional":true},"generate_signing_key":{"type":"bool","description":"Whether Vault should generate the signing key pair internally.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"private_key":{"type":"string","description":"Private key part the SSH CA key pair; required if generate_signing_key is false.","description_kind":"plain","optional":true,"computed":true,"sensitive":true},"public_key":{"type":"string","description":"Public key part the SSH CA key pair; required if generate_signing_key is false.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_ssh_secret_backend_role":{"version":0,"block":{"attributes":{"algorithm_signer":{"type":"string","description_kind":"plain","optional":true,"computed":true},"allow_bare_domains":{"type":"bool","description_kind":"plain","optional":true},"allow_host_certificates":{"type":"bool","description_kind":"plain","optional":true},"allow_subdomains":{"type":"bool","description_kind":"plain","optional":true},"allow_user_certificates":{"type":"bool","description_kind":"plain","optional":true},"allow_user_key_ids":{"type":"bool","description_kind":"plain","optional":true},"allowed_critical_options":{"type":"string","description_kind":"plain","optional":true},"allowed_domains":{"type":"string","description_kind":"plain","optional":true},"allowed_domains_template":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"allowed_extensions":{"type":"string","description_kind":"plain","optional":true},"allowed_users":{"type":"string","description_kind":"plain","optional":true},"allowed_users_template":{"type":"bool","description_kind":"plain","optional":true},"backend":{"type":"string","description_kind":"plain","required":true},"cidr_list":{"type":"string","description_kind":"plain","optional":true},"default_critical_options":{"type":["map","string"],"description_kind":"plain","optional":true},"default_extensions":{"type":["map","string"],"description_kind":"plain","optional":true},"default_user":{"type":"string","description_kind":"plain","optional":true},"default_user_template":{"type":"bool","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_id_format":{"type":"string","description_kind":"plain","optional":true},"key_type":{"type":"string","description_kind":"plain","required":true},"max_ttl":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name for the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"not_before_duration":{"type":"string","description":"Specifies the duration by which to backdate the ValidAfter property. Uses duration format strings.","description_kind":"plain","optional":true,"computed":true},"ttl":{"type":"string","description_kind":"plain","optional":true,"computed":true}},"block_types":{"allowed_user_key_config":{"nesting_mode":"set","block":{"attributes":{"lengths":{"type":["list","number"],"description":"List of allowed key lengths, vault-1.10 and above","description_kind":"plain","required":true},"type":{"type":"string","description":"Key type, choices:\nrsa, ecdsa, ec, dsa, ed25519, ssh-rsa, ssh-dss, ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521","description_kind":"plain","required":true}},"description":"Set of allowed public key types and their relevant configuration","description_kind":"plain"}}},"description_kind":"plain"}},"vault_terraform_cloud_secret_backend":{"version":1,"block":{"attributes":{"address":{"type":"string","description":"Specifies the address of the Terraform Cloud instance, provided as \"host:port\" like \"127.0.0.1:8500\".","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the Vault Terraform Cloud mount to configure","description_kind":"plain","optional":true},"base_path":{"type":"string","description":"Specifies the base path for the Terraform Cloud or Enterprise API.","description_kind":"plain","optional":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"token":{"type":"string","description":"Specifies the Terraform Cloud access token to use.","description_kind":"plain","optional":true,"sensitive":true}},"description_kind":"plain"}},"vault_terraform_cloud_secret_creds":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Terraform Cloud secret backend to generate tokens from","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_id":{"type":"string","description":"Associated Vault lease ID, if one exists","description_kind":"plain","computed":true,"sensitive":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"Name of the Terraform Cloud or Enterprise organization","description_kind":"plain","computed":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"team_id":{"type":"string","description":"ID of the Terraform Cloud or Enterprise team under organization (e.g., settings/teams/team-xxxxxxxxxxxxx)","description_kind":"plain","computed":true},"token":{"type":"string","description":"Terraform Token provided by the Vault backend","description_kind":"plain","computed":true,"sensitive":true},"token_id":{"type":"string","description":"ID of the Terraform Token provided","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_terraform_cloud_secret_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the Terraform Cloud Secret Backend the role belongs to.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"Maximum allowed lease for generated credentials. If not set or set to 0, will use system default.","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of an existing role against which to create this Terraform Cloud credential","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"Name of the Terraform Cloud or Enterprise organization","description_kind":"plain","optional":true},"team_id":{"type":"string","description":"ID of the Terraform Cloud or Enterprise team under organization (e.g., settings/teams/team-xxxxxxxxxxxxx)","description_kind":"plain","optional":true},"ttl":{"type":"number","description":"Default lease for generated credentials. If not set or set to 0, will use system default.","description_kind":"plain","optional":true},"user_id":{"type":"string","description":"ID of the Terraform Cloud or Enterprise user (e.g., user-xxxxxxxxxxxxxxxx)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_token":{"version":0,"block":{"attributes":{"client_token":{"type":"string","description":"The client token.","description_kind":"plain","computed":true,"sensitive":true},"display_name":{"type":"string","description":"The display name of the token.","description_kind":"plain","optional":true},"explicit_max_ttl":{"type":"string","description":"The explicit max TTL of the token.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"The token lease duration.","description_kind":"plain","computed":true},"lease_started":{"type":"string","description":"The token lease started on.","description_kind":"plain","computed":true},"metadata":{"type":["map","string"],"description":"Metadata to be associated with the token.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"no_default_policy":{"type":"bool","description":"Flag to disable the default policy.","description_kind":"plain","optional":true},"no_parent":{"type":"bool","description":"Flag to create a token without parent.","description_kind":"plain","optional":true,"computed":true},"num_uses":{"type":"number","description":"The number of allowed uses of the token.","description_kind":"plain","optional":true,"computed":true},"period":{"type":"string","description":"The period of the token.","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"List of policies.","description_kind":"plain","optional":true},"renew_increment":{"type":"number","description":"The renew increment.","description_kind":"plain","optional":true},"renew_min_lease":{"type":"number","description":"The minimum lease to renew token.","description_kind":"plain","optional":true},"renewable":{"type":"bool","description":"Flag to allow the token to be renewed","description_kind":"plain","optional":true,"computed":true},"role_name":{"type":"string","description":"The token role name.","description_kind":"plain","optional":true},"ttl":{"type":"string","description":"The TTL period of the token.","description_kind":"plain","optional":true},"wrapped_token":{"type":"string","description":"The client wrapped token.","description_kind":"plain","computed":true,"sensitive":true},"wrapping_accessor":{"type":"string","description":"The client wrapping accessor.","description_kind":"plain","computed":true,"sensitive":true},"wrapping_ttl":{"type":"string","description":"The TTL period of the wrapped token.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_token_auth_backend_role":{"version":0,"block":{"attributes":{"allowed_entity_aliases":{"type":["set","string"],"description":"Set of allowed entity aliases for this role.","description_kind":"plain","optional":true},"allowed_policies":{"type":["set","string"],"description":"List of allowed policies for given role.","description_kind":"plain","optional":true},"allowed_policies_glob":{"type":["set","string"],"description":"Set of allowed policies with glob match for given role.","description_kind":"plain","optional":true},"disallowed_policies":{"type":["set","string"],"description":"List of disallowed policies for given role.","description_kind":"plain","optional":true},"disallowed_policies_glob":{"type":["set","string"],"description":"Set of disallowed policies with glob match for given role.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"orphan":{"type":"bool","description":"If true, tokens created against this policy will be orphan tokens.","description_kind":"plain","optional":true},"path_suffix":{"type":"string","description":"Tokens created against this role will have the given suffix as part of their path in addition to the role name.","description_kind":"plain","optional":true},"renewable":{"type":"bool","description":"Whether to disable the ability of the token to be renewed past its initial TTL.","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transform_alphabet":{"version":0,"block":{"attributes":{"alphabet":{"type":"string","description":"A string of characters that contains the alphabet set.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the alphabet.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"The mount path for a back-end, for example, the path given in \"$ vault auth enable -path=my-aws aws\".","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_transform_role":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"The mount path for a back-end, for example, the path given in \"$ vault auth enable -path=my-aws aws\".","description_kind":"plain","required":true},"transformations":{"type":["list","string"],"description":"A comma separated string or slice of transformations to use.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transform_template":{"version":0,"block":{"attributes":{"alphabet":{"type":"string","description":"The alphabet to use for this template. This is only used during FPE transformations.","description_kind":"plain","optional":true},"decode_formats":{"type":["map","string"],"description":"The map of regular expression templates used to customize decoded outputs.\nOnly applicable to FPE transformations.","description_kind":"plain","optional":true},"encode_format":{"type":"string","description":"The regular expression template used for encoding values.\nOnly applicable to FPE transformations.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the template.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"The mount path for a back-end, for example, the path given in \"$ vault auth enable -path=my-aws aws\".","description_kind":"plain","required":true},"pattern":{"type":"string","description":"The pattern used for matching. Currently, only regular expression pattern is supported.","description_kind":"plain","optional":true},"type":{"type":"string","description":"The pattern type to use for match detection. Currently, only regex is supported.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transform_transformation":{"version":0,"block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"The set of roles allowed to perform this transformation.","description_kind":"plain","optional":true},"deletion_allowed":{"type":"bool","description":"If true, this transform can be deleted. Otherwise deletion is blocked while this value remains false.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"masking_character":{"type":"string","description":"The character used to replace data when in masking mode","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of the transformation.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"The mount path for a back-end, for example, the path given in \"$ vault auth enable -path=my-aws aws\".","description_kind":"plain","required":true},"template":{"type":"string","description":"The name of the template to use.","description_kind":"plain","optional":true},"templates":{"type":["list","string"],"description":"Templates configured for transformation.","description_kind":"plain","optional":true,"computed":true},"tweak_source":{"type":"string","description":"The source of where the tweak value comes from. Only valid when in FPE mode.","description_kind":"plain","optional":true},"type":{"type":"string","description":"The type of transformation to perform.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transit_secret_backend_key":{"version":0,"block":{"attributes":{"allow_plaintext_backup":{"type":"bool","description":"If set, enables taking backup of named key in the plaintext format. Once set, this cannot be disabled.","description_kind":"plain","optional":true},"auto_rotate_period":{"type":"number","description":"Amount of seconds the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key.","description_kind":"plain","optional":true,"computed":true},"backend":{"type":"string","description":"The Transit secret backend the resource belongs to.","description_kind":"plain","required":true},"convergent_encryption":{"type":"bool","description":"Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires derived to be set to true.","description_kind":"plain","optional":true},"deletion_allowed":{"type":"bool","description":"Specifies if the key is allowed to be deleted.","description_kind":"plain","optional":true},"derived":{"type":"bool","description":"Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.","description_kind":"plain","optional":true},"exportable":{"type":"bool","description":"Enables keys to be exportable. This allows for all the valid keys in the key ring to be exported. Once set, this cannot be disabled.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_size":{"type":"number","description":"The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC; this value must be between 32 and 512.","description_kind":"plain","optional":true},"keys":{"type":["list",["map","string"]],"description":"List of key versions in the keyring.","description_kind":"plain","computed":true},"latest_version":{"type":"number","description":"Latest key version in use in the keyring","description_kind":"plain","computed":true},"min_available_version":{"type":"number","description":"Minimum key version available for use.","description_kind":"plain","computed":true},"min_decryption_version":{"type":"number","description":"Minimum key version to use for decryption.","description_kind":"plain","optional":true},"min_encryption_version":{"type":"number","description":"Minimum key version to use for encryption","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the encryption key to create.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"supports_decryption":{"type":"bool","description":"Whether or not the key supports decryption, based on key type.","description_kind":"plain","computed":true},"supports_derivation":{"type":"bool","description":"Whether or not the key supports derivation, based on key type.","description_kind":"plain","computed":true},"supports_encryption":{"type":"bool","description":"Whether or not the key supports encryption, based on key type.","description_kind":"plain","computed":true},"supports_signing":{"type":"bool","description":"Whether or not the key supports signing, based on key type.","description_kind":"plain","computed":true},"type":{"type":"string","description":"Specifies the type of key to create. The currently-supported types are: aes128-gcm96, aes256-gcm96, chacha20-poly1305, ed25519, ecdsa-p256, ecdsa-p384, ecdsa-p521, hmac, rsa-2048, rsa-3072, rsa-4096","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transit_secret_cache_config":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The Transit secret backend the resource belongs to.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"size":{"type":"number","description":"Number of cache entries. A size of 0 mean unlimited.","description_kind":"plain","required":true}},"description_kind":"plain"}}},"data_source_schemas":{"vault_ad_access_credentials":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"AD Secret Backend to read credentials from.","description_kind":"plain","required":true},"current_password":{"type":"string","description":"Password for the service account.","description_kind":"plain","computed":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"last_password":{"type":"string","description":"Last known password for the service account.","description_kind":"plain","computed":true,"sensitive":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"username":{"type":"string","description":"Name of the service account.","description_kind":"plain","computed":true}},"description_kind":"plain","deprecated":true}},"vault_approle_auth_backend_role_id":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_id":{"type":"string","description":"The RoleID of the role.","description_kind":"plain","computed":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor of the auth backend.","description_kind":"plain","computed":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration in seconds","description_kind":"plain","computed":true},"description":{"type":"string","description":"The description of the auth backend.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"listing_visibility":{"type":"string","description":"Specifies whether to show this mount in the UI-specific listing endpoint.","description_kind":"plain","computed":true},"local":{"type":"bool","description":"Specifies if the auth method is local only","description_kind":"plain","computed":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration in seconds","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"The auth backend mount point.","description_kind":"plain","required":true},"type":{"type":"string","description":"The name of the auth backend.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_auth_backends":{"version":0,"block":{"attributes":{"accessors":{"type":["list","string"],"description":"The accessors of the auth backends.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"paths":{"type":["list","string"],"description":"The auth backend mount points.","description_kind":"plain","computed":true},"type":{"type":"string","description":"The type of the auth backend.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_access_credentials":{"version":0,"block":{"attributes":{"access_key":{"type":"string","description":"AWS access key ID read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"backend":{"type":"string","description":"AWS Secret Backend to read credentials from.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"Lease duration in seconds relative to the time in lease_start_time.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"Lease identifier assigned by vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"lease_start_time":{"type":"string","description":"Time at which the lease was read, using the clock of the system where Terraform was running","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"region":{"type":"string","description":"Region the read credentials belong to.","description_kind":"plain","optional":true},"role":{"type":"string","description":"AWS Secret Role to read credentials from.","description_kind":"plain","required":true},"role_arn":{"type":"string","description":"ARN to use if multiple are available in the role. Required if the role has multiple ARNs.","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"AWS secret key read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"security_token":{"type":"string","description":"AWS security token read from Vault. (Only returned if type is 'sts').","description_kind":"plain","computed":true,"sensitive":true},"ttl":{"type":"string","description":"User specified Time-To-Live for the STS token. Uses the Role defined default_sts_ttl when not specified","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of credentials to read. Must be either 'creds' for Access Key and Secret Key, or 'sts' for STS.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_static_access_credentials":{"version":0,"block":{"attributes":{"access_key":{"type":"string","description":"AWS access key ID read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"backend":{"type":"string","description":"AWS Secret Backend to read credentials from.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"AWS secret key read from Vault.","description_kind":"plain","computed":true,"sensitive":true}},"description_kind":"plain"}},"vault_azure_access_credentials":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Azure Secret Backend to read credentials from.","description_kind":"plain","required":true},"client_id":{"type":"string","description":"The client id for credentials to query the Azure APIs.","description_kind":"plain","computed":true},"client_secret":{"type":"string","description":"The client secret for credentials to query the Azure APIs.","description_kind":"plain","computed":true,"sensitive":true},"environment":{"type":"string","description":"The Azure environment to use during credential validation.\nDefaults to the Azure Public Cloud.\nSome possible values: AzurePublicCloud, AzureUSGovernmentCloud","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"Lease duration in seconds relative to the time in lease_start_time.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"Lease identifier assigned by vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"lease_start_time":{"type":"string","description":"Time at which the lease was read, using the clock of the system where Terraform was running","description_kind":"plain","computed":true},"max_cred_validation_seconds":{"type":"number","description":"If 'validate_creds' is true, the number of seconds after which to give up validating credentials.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"num_seconds_between_tests":{"type":"number","description":"If 'validate_creds' is true, the number of seconds to wait between each test of generated credentials.","description_kind":"plain","optional":true},"num_sequential_successes":{"type":"number","description":"If 'validate_creds' is true, the number of sequential successes required to validate generated credentials.","description_kind":"plain","optional":true},"role":{"type":"string","description":"Azure Secret Role to read credentials from.","description_kind":"plain","required":true},"subscription_id":{"type":"string","description":"The subscription ID to use during credential validation. Defaults to the subscription ID configured in the Vault backend","description_kind":"plain","optional":true},"tenant_id":{"type":"string","description":"The tenant ID to use during credential validation. Defaults to the tenant ID configured in the Vault backend","description_kind":"plain","optional":true},"validate_creds":{"type":"bool","description":"Whether generated credentials should be validated before being returned.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_gcp_auth_backend_role":{"version":1,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"bound_instance_groups":{"type":["set","string"],"description_kind":"plain","computed":true},"bound_labels":{"type":["set","string"],"description_kind":"plain","computed":true},"bound_projects":{"type":["set","string"],"description_kind":"plain","computed":true},"bound_regions":{"type":["set","string"],"description_kind":"plain","computed":true},"bound_service_accounts":{"type":["set","string"],"description_kind":"plain","computed":true},"bound_zones":{"type":["set","string"],"description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_id":{"type":"string","description":"The RoleID of the GCP auth role.","description_kind":"plain","computed":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true},"type":{"type":"string","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_generic_secret":{"version":1,"block":{"attributes":{"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"Lease duration in seconds relative to the time in lease_start_time.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"Lease identifier assigned by vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"lease_start_time":{"type":"string","description":"Time at which the lease was read, using the clock of the system where Terraform was running","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path from which a secret will be read.","description_kind":"plain","required":true},"version":{"type":"number","description_kind":"plain","optional":true},"with_lease_start_time":{"type":"bool","description":"If set to true, stores 'lease_start_time' in the TF state.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_entity":{"version":0,"block":{"attributes":{"alias_id":{"type":"string","description":"ID of the alias.","description_kind":"plain","optional":true,"computed":true},"alias_mount_accessor":{"type":"string","description":"Accessor of the mount to which the alias belongs to. This should be supplied in conjunction with `alias_name`.","description_kind":"plain","optional":true,"computed":true},"alias_name":{"type":"string","description":"Name of the alias. This should be supplied in conjunction with `alias_mount_accessor`.","description_kind":"plain","optional":true,"computed":true},"aliases":{"type":["set",["object",{"canonical_id":"string","creation_time":"string","id":"string","last_update_time":"string","merged_from_canonical_ids":["set","string"],"metadata":["map","string"],"mount_accessor":"string","mount_path":"string","mount_type":"string","name":"string"}]],"description_kind":"plain","computed":true},"creation_time":{"type":"string","description_kind":"plain","computed":true},"data_json":{"type":"string","description":"Entity data from Vault in JSON String form","description_kind":"plain","computed":true},"direct_group_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"disabled":{"type":"bool","description_kind":"plain","computed":true},"entity_id":{"type":"string","description":"ID of the entity.","description_kind":"plain","optional":true,"computed":true},"entity_name":{"type":"string","description":"Name of the entity.","description_kind":"plain","optional":true,"computed":true},"group_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"inherited_group_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"last_update_time":{"type":"string","description_kind":"plain","computed":true},"merged_entity_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"metadata":{"type":["map","string"],"description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description_kind":"plain","computed":true},"policies":{"type":["set","string"],"description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_group":{"version":1,"block":{"attributes":{"alias_canonical_id":{"type":"string","description_kind":"plain","computed":true},"alias_creation_time":{"type":"string","description_kind":"plain","computed":true},"alias_id":{"type":"string","description":"ID of the alias.","description_kind":"plain","optional":true,"computed":true},"alias_last_update_time":{"type":"string","description_kind":"plain","computed":true},"alias_merged_from_canonical_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"alias_metadata":{"type":["map","string"],"description_kind":"plain","computed":true},"alias_mount_accessor":{"type":"string","description":"Accessor of the mount to which the alias belongs to. This should be supplied in conjunction with `alias_name`.","description_kind":"plain","optional":true,"computed":true},"alias_mount_path":{"type":"string","description_kind":"plain","computed":true},"alias_mount_type":{"type":"string","description_kind":"plain","computed":true},"alias_name":{"type":"string","description":"Name of the alias. This should be supplied in conjunction with `alias_mount_accessor`.","description_kind":"plain","optional":true,"computed":true},"creation_time":{"type":"string","description_kind":"plain","computed":true},"data_json":{"type":"string","description":"Group data from Vault in JSON String form","description_kind":"plain","computed":true},"group_id":{"type":"string","description":"ID of the group.","description_kind":"plain","optional":true,"computed":true},"group_name":{"type":"string","description":"Name of the group.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"last_update_time":{"type":"string","description_kind":"plain","computed":true},"member_entity_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"member_group_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"metadata":{"type":["map","string"],"description_kind":"plain","computed":true},"modify_index":{"type":"number","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description_kind":"plain","computed":true},"parent_group_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"policies":{"type":["set","string"],"description_kind":"plain","computed":true},"type":{"type":"string","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_oidc_client_creds":{"version":0,"block":{"attributes":{"client_id":{"type":"string","description":"The Client ID from Vault.","description_kind":"plain","computed":true},"client_secret":{"type":"string","description":"The Client Secret from Vault.","description_kind":"plain","computed":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the client.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_openid_config":{"version":0,"block":{"attributes":{"authorization_endpoint":{"type":"string","description":"The Authorization Endpoint for the provider.","description_kind":"plain","computed":true},"grant_types_supported":{"type":["list","string"],"description":"The grant types supported by the provider.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"id_token_signing_alg_values_supported":{"type":["list","string"],"description":"The signing algorithms supported by the provider.","description_kind":"plain","computed":true},"issuer":{"type":"string","description":"The URL of the issuer for the provider.","description_kind":"plain","computed":true},"jwks_uri":{"type":"string","description":"The well known keys URI for the provider.","description_kind":"plain","computed":true},"name":{"type":"string","description":"The name of the provider.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"request_uri_parameter_supported":{"type":"bool","description":"Specifies whether Request URI Parameter is supported by the provider.","description_kind":"plain","computed":true},"response_types_supported":{"type":["list","string"],"description":"The response types supported by the provider.","description_kind":"plain","computed":true},"scopes_supported":{"type":["list","string"],"description":"The scopes supported by the provider.","description_kind":"plain","computed":true},"subject_types_supported":{"type":["list","string"],"description":"The subject types supported by the provider.","description_kind":"plain","computed":true},"token_endpoint":{"type":"string","description":"The Token Endpoint for the provider.","description_kind":"plain","computed":true},"token_endpoint_auth_methods_supported":{"type":["list","string"],"description":"The token endpoint auth methods supported by the provider.","description_kind":"plain","computed":true},"userinfo_endpoint":{"type":"string","description":"The User Info Endpoint for the provider.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_oidc_public_keys":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"keys":{"type":["list",["map","string"]],"description":"The public portion of keys for an OIDC provider. Clients can use them to validate the authenticity of an identity token.","description_kind":"plain","computed":true},"name":{"type":"string","description":"The name of the provider.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kubernetes_auth_backend_config":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the kubernetes backend to configure.","description_kind":"plain","optional":true},"disable_iss_validation":{"type":"bool","description":"Optional disable JWT issuer validation. Allows to skip ISS validation.","description_kind":"plain","optional":true,"computed":true},"disable_local_ca_jwt":{"type":"bool","description":"Optional disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"Optional JWT issuer. If no issuer is specified, kubernetes.io/serviceaccount will be used as the default issuer.","description_kind":"plain","optional":true,"computed":true},"kubernetes_ca_cert":{"type":"string","description":"PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.","description_kind":"plain","optional":true,"computed":true},"kubernetes_host":{"type":"string","description":"Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"pem_keys":{"type":["list","string"],"description":"Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_kubernetes_auth_backend_role":{"version":0,"block":{"attributes":{"alias_name_source":{"type":"string","description":"Method used for generating identity aliases.","description_kind":"plain","computed":true},"audience":{"type":"string","description":"Optional Audience claim to verify in the JWT.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the kubernetes backend to configure.","description_kind":"plain","optional":true},"bound_service_account_names":{"type":["set","string"],"description":"List of service account names able to access this role. If set to \"*\" all names are allowed, both this and bound_service_account_namespaces can not be \"*\".","description_kind":"plain","computed":true},"bound_service_account_namespaces":{"type":["set","string"],"description":"List of namespaces allowed to access this role. If set to \"*\" all namespaces are allowed, both this and bound_service_account_names can not be set to \"*\".","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kubernetes_service_account_token":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The Kubernetes secret backend to generate service account tokens from.","description_kind":"plain","required":true},"cluster_role_binding":{"type":"bool","description":"If true, generate a ClusterRoleBinding to grant permissions across the whole cluster instead of within a namespace.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"kubernetes_namespace":{"type":"string","description":"The name of the Kubernetes namespace in which to generate the credentials.","description_kind":"plain","required":true},"lease_duration":{"type":"number","description":"The duration of the lease in seconds.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"The lease identifier assigned by Vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description":"The name of the role.","description_kind":"plain","required":true},"service_account_name":{"type":"string","description":"The name of the service account associated with the token.","description_kind":"plain","computed":true},"service_account_namespace":{"type":"string","description":"The Kubernetes namespace that the service account resides in.","description_kind":"plain","computed":true},"service_account_token":{"type":"string","description":"The Kubernetes service account token.","description_kind":"plain","computed":true,"sensitive":true},"ttl":{"type":"string","description":"The TTL of the generated Kubernetes service account token, specified in seconds or as a Go duration format string","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kv_secret":{"version":0,"block":{"attributes":{"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"Lease duration in seconds.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"Lease identifier assigned by Vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path of the KV-V1 secret.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_kv_secret_subkeys_v2":{"version":0,"block":{"attributes":{"data":{"type":["map","string"],"description":"Subkeys stored as a map of strings.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"Subkeys for the KV-V2 secret read from Vault.","description_kind":"plain","computed":true},"depth":{"type":"number","description":"Specifies the deepest nesting level to provide in the output.If non-zero, keys that reside at the specified depth value will be artificially treated as leaves and will thus be 'null' even if further underlying sub-keys exist.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Path where KV-V2 engine is mounted","description_kind":"plain","required":true},"name":{"type":"string","description":"Full name of the secret. For a nested secret, the name is the nested path excluding the mount and data prefix. For example, for a secret at 'kvv2/data/foo/bar/baz', the name is 'foo/bar/baz'","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where the generic secret will be written.","description_kind":"plain","computed":true},"version":{"type":"number","description":"Specifies the version to return. If not set the latest version is returned.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kv_secret_v2":{"version":0,"block":{"attributes":{"created_time":{"type":"string","description":"Time at which the secret was created","description_kind":"plain","computed":true},"custom_metadata":{"type":["map","string"],"description":"Custom metadata for the secret","description_kind":"plain","computed":true},"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"deletion_time":{"type":"string","description":"Deletion time for the secret","description_kind":"plain","computed":true},"destroyed":{"type":"bool","description":"Indicates whether the secret has been destroyed","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Path where KV-V2 engine is mounted","description_kind":"plain","required":true},"name":{"type":"string","description":"Full name of the secret. For a nested secret, the name is the nested path excluding the mount and data prefix. For example, for a secret at 'kvv2/data/foo/bar/baz', the name is 'foo/bar/baz'","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where the KVV2 secret is written.","description_kind":"plain","computed":true},"version":{"type":"number","description":"Version of the secret to retrieve","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kv_secrets_list":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"names":{"type":["list","string"],"description":"List of all secret names.","description_kind":"plain","computed":true,"sensitive":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full KV-V1 path where secrets will be listed.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_kv_secrets_list_v2":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Path where KV-V2 engine is mounted","description_kind":"plain","required":true},"name":{"type":"string","description":"Full named path of the secret. For a nested secret, the name is the nested path excluding the mount and data prefix. For example, for a secret at 'kvv2/data/foo/bar/baz', the name is 'foo/bar/baz'","description_kind":"plain","optional":true},"names":{"type":["list","string"],"description":"List of all secret names.","description_kind":"plain","computed":true,"sensitive":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where the KV-V2 secrets are listed.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_ldap_dynamic_credentials":{"version":0,"block":{"attributes":{"distinguished_names":{"type":["list","string"],"description":"List of the distinguished names (DN) created.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"Lease duration in seconds.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"Lease identifier assigned by Vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"mount":{"type":"string","description":"LDAP Secret Backend to read credentials from.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"password":{"type":"string","description":"Password for the dynamic role.","description_kind":"plain","computed":true,"sensitive":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"username":{"type":"string","description":"Name of the dynamic role.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_ldap_static_credentials":{"version":0,"block":{"attributes":{"dn":{"type":"string","description":"Distinguished name (DN) of the existing LDAP entry to manage password rotation for.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"last_password":{"type":"string","description":"Last known password for the static role.","description_kind":"plain","computed":true,"sensitive":true},"last_vault_rotation":{"type":"string","description":"Last time Vault rotated this static role's password.","description_kind":"plain","computed":true},"mount":{"type":"string","description":"LDAP Secret Backend to read credentials from.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"password":{"type":"string","description":"Password for the static role.","description_kind":"plain","computed":true,"sensitive":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"rotation_period":{"type":"number","description":"How often Vault should rotate the password of the user entry.","description_kind":"plain","computed":true},"ttl":{"type":"number","description":"Duration in seconds after which the issued credential should expire.","description_kind":"plain","computed":true},"username":{"type":"string","description":"Name of the static role.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_namespace":{"version":0,"block":{"attributes":{"custom_metadata":{"type":["map","string"],"description":"Metadata associated with this namespace.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Namespace ID.","description_kind":"plain","computed":true},"path":{"type":"string","description":"Namespace path.","description_kind":"plain","optional":true},"path_fq":{"type":"string","description":"The fully qualified namespace path.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_namespaces":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"paths":{"type":["set","string"],"description":"Namespace paths.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_nomad_access_token":{"version":0,"block":{"attributes":{"accessor_id":{"type":"string","description":"The public identifier for a specific token. It can be used to look up information about a token or to revoke a token.","description_kind":"plain","computed":true},"backend":{"type":"string","description":"Nomad secret backend to generate tokens from.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"secret_id":{"type":"string","description":"Used to make requests to Nomad and should be kept private.","description_kind":"plain","computed":true,"sensitive":true}},"description_kind":"plain"}},"vault_pki_secret_backend_issuer":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"ca_chain":{"type":["list","string"],"description":"The CA chain as a list of format specific certificates","description_kind":"plain","computed":true},"certificate":{"type":"string","description":"The certificate.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer_id":{"type":"string","description":"ID of the issuer.","description_kind":"plain","computed":true},"issuer_name":{"type":"string","description":"Name of the issuer.","description_kind":"plain","computed":true},"issuer_ref":{"type":"string","description":"Reference to an existing issuer.","description_kind":"plain","required":true},"key_id":{"type":"string","description":"ID of the key used by the issuer.","description_kind":"plain","computed":true},"leaf_not_after_behavior":{"type":"string","description":"Behavior of a leaf's NotAfter field during issuance.","description_kind":"plain","computed":true},"manual_chain":{"type":["list","string"],"description":"Chain of issuer references to build this issuer's computed CAChain field from, when non-empty","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"usage":{"type":"string","description":"Allowed usages for this issuer.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_pki_secret_backend_issuers":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_info":{"type":["map","string"],"description":"Map of issuer strings read from Vault.","description_kind":"plain","computed":true},"key_info_json":{"type":"string","description":"JSON-encoded key info data read from Vault.","description_kind":"plain","computed":true},"keys":{"type":["list","string"],"description":"Keys used by issuers under the backend path.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_key":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_id":{"type":"string","description":"ID of the key used.","description_kind":"plain","computed":true},"key_name":{"type":"string","description":"Name of the key.","description_kind":"plain","computed":true},"key_ref":{"type":"string","description":"Reference to an existing key.","description_kind":"plain","required":true},"key_type":{"type":"string","description":"Type of the key.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_keys":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_info":{"type":["map","string"],"description":"Map of key strings read from Vault.","description_kind":"plain","computed":true},"key_info_json":{"type":"string","description":"JSON-encoded key data read from Vault.","description_kind":"plain","computed":true},"keys":{"type":["list","string"],"description":"Keys used under the backend path.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_policy_document":{"version":0,"block":{"attributes":{"hcl":{"type":"string","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"block_types":{"rule":{"nesting_mode":"list","block":{"attributes":{"capabilities":{"type":["list","string"],"description_kind":"plain","required":true},"description":{"type":"string","description_kind":"plain","optional":true},"max_wrapping_ttl":{"type":"string","description_kind":"plain","optional":true},"min_wrapping_ttl":{"type":"string","description_kind":"plain","optional":true},"path":{"type":"string","description_kind":"plain","required":true},"required_parameters":{"type":["list","string"],"description_kind":"plain","optional":true}},"block_types":{"allowed_parameter":{"nesting_mode":"list","block":{"attributes":{"key":{"type":"string","description_kind":"plain","required":true},"value":{"type":["list","string"],"description_kind":"plain","required":true}},"description_kind":"plain"}},"denied_parameter":{"nesting_mode":"list","block":{"attributes":{"key":{"type":"string","description_kind":"plain","required":true},"value":{"type":["list","string"],"description_kind":"plain","required":true}},"description_kind":"plain"}}},"description":"The policy rule","description_kind":"plain"}}},"description_kind":"plain"}},"vault_raft_autopilot_state":{"version":0,"block":{"attributes":{"failure_tolerance":{"type":"number","description":"How many nodes could fail before the cluster becomes unhealthy","description_kind":"plain","computed":true},"healthy":{"type":"bool","description":"Health status","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"leader":{"type":"string","description":"Current leader of Vault","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"optimistic_failure_tolerance":{"type":"number","description":"The cluster-level optimistic failure tolerance.","description_kind":"plain","computed":true},"redundancy_zones":{"type":["map","string"],"description":"Additional output related to redundancy zones stored as a map of strings.","description_kind":"plain","computed":true},"redundancy_zones_json":{"type":"string","description":"Subkeys for the redundancy zones read from Vault.","description_kind":"plain","computed":true},"servers":{"type":["map","string"],"description":"Additional output related to servers stored as a map of strings.","description_kind":"plain","computed":true},"servers_json":{"type":"string","description":"Subkeys for the servers read from Vault.","description_kind":"plain","computed":true},"upgrade_info":{"type":["map","string"],"description":"Additional output related to upgrade info stored as a map of strings.","description_kind":"plain","computed":true},"upgrade_info_json":{"type":"string","description":"Subkeys for the servers read from Vault.","description_kind":"plain","computed":true},"voters":{"type":["list","string"],"description":"The voters in the Vault cluster.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_transform_decode":{"version":0,"block":{"attributes":{"batch_input":{"type":["list",["map","string"]],"description":"Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.","description_kind":"plain","optional":true},"batch_results":{"type":["list",["map","string"]],"description":"The result of decoding batch_input.","description_kind":"plain","optional":true,"computed":true},"decoded_value":{"type":"string","description":"The result of decoding a value.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to backend from which to retrieve data.","description_kind":"plain","required":true},"role_name":{"type":"string","description":"The name of the role.","description_kind":"plain","required":true},"transformation":{"type":"string","description":"The transformation to perform. If no value is provided and the role contains a single transformation, this value will be inferred from the role.","description_kind":"plain","optional":true},"tweak":{"type":"string","description":"The tweak value to use. Only applicable for FPE transformations","description_kind":"plain","optional":true},"value":{"type":"string","description":"The value in which to decode.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transform_encode":{"version":0,"block":{"attributes":{"batch_input":{"type":["list",["map","string"]],"description":"Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.","description_kind":"plain","optional":true},"batch_results":{"type":["list",["map","string"]],"description":"The result of encoding batch_input.","description_kind":"plain","optional":true,"computed":true},"encoded_value":{"type":"string","description":"The result of encoding a value.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to backend from which to retrieve data.","description_kind":"plain","required":true},"role_name":{"type":"string","description":"The name of the role.","description_kind":"plain","required":true},"transformation":{"type":"string","description":"The transformation to perform. If no value is provided and the role contains a single transformation, this value will be inferred from the role.","description_kind":"plain","optional":true},"tweak":{"type":"string","description":"The tweak value to use. Only applicable for FPE transformations","description_kind":"plain","optional":true},"value":{"type":"string","description":"The value in which to encode.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transit_decrypt":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The Transit secret backend the key belongs to.","description_kind":"plain","required":true},"ciphertext":{"type":"string","description":"Transit encrypted cipher text.","description_kind":"plain","required":true},"context":{"type":"string","description":"Specifies the context for key derivation","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key":{"type":"string","description":"Name of the decryption key to use.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"plaintext":{"type":"string","description":"Decrypted plain text","description_kind":"plain","computed":true,"sensitive":true}},"description_kind":"plain"}},"vault_transit_encrypt":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The Transit secret backend the key belongs to.","description_kind":"plain","required":true},"ciphertext":{"type":"string","description":"Transit encrypted cipher text.","description_kind":"plain","computed":true},"context":{"type":"string","description":"Specifies the context for key derivation","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key":{"type":"string","description":"Name of the encryption key to use.","description_kind":"plain","required":true},"key_version":{"type":"number","description":"The version of the key to use for encryption","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"plaintext":{"type":"string","description":"Map of strings read from Vault.","description_kind":"plain","required":true,"sensitive":true}},"description_kind":"plain"}}}}}} +{"format_version":"1.0","provider_schemas":{"registry.terraform.io/hashicorp/vault":{"provider":{"version":0,"block":{"attributes":{"add_address_to_env":{"type":"string","description":"If true, adds the value of the `address` argument to the Terraform process environment.","description_kind":"plain","optional":true},"address":{"type":"string","description":"URL of the root of the target Vault server.","description_kind":"plain","required":true},"ca_cert_dir":{"type":"string","description":"Path to directory containing CA certificate files to validate the server's certificate.","description_kind":"plain","optional":true},"ca_cert_file":{"type":"string","description":"Path to a CA certificate file to validate the server's certificate.","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum TTL for secret leases requested by this provider.","description_kind":"plain","optional":true},"max_retries":{"type":"number","description":"Maximum number of retries when a 5xx error code is encountered.","description_kind":"plain","optional":true},"max_retries_ccc":{"type":"number","description":"Maximum number of retries for Client Controlled Consistency related operations","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The namespace to use. Available only for Vault Enterprise.","description_kind":"plain","optional":true},"set_namespace_from_token":{"type":"bool","description":"In the case where the Vault token is for a specific namespace and the provider namespace is not configured, use the token namespace as the root namespace for all resources.","description_kind":"plain","optional":true},"skip_child_token":{"type":"bool","description":"Set this to true to prevent the creation of ephemeral child token used by this provider.","description_kind":"plain","optional":true},"skip_get_vault_version":{"type":"bool","description":"Skip the dynamic fetching of the Vault server version.","description_kind":"plain","optional":true},"skip_tls_verify":{"type":"bool","description":"Set this to true only if the target Vault server is an insecure development instance.","description_kind":"plain","optional":true},"tls_server_name":{"type":"string","description":"Name to use as the SNI host when connecting via TLS.","description_kind":"plain","optional":true},"token":{"type":"string","description":"Token to use to authenticate to Vault.","description_kind":"plain","optional":true},"token_name":{"type":"string","description":"Token name to use for creating the Vault child token.","description_kind":"plain","optional":true},"vault_version_override":{"type":"string","description":"Override the Vault server version, which is normally determined dynamically from the target Vault server","description_kind":"plain","optional":true}},"block_types":{"auth_login":{"nesting_mode":"list","block":{"attributes":{"method":{"type":"string","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"parameters":{"type":["map","string"],"description_kind":"plain","optional":true,"sensitive":true},"path":{"type":"string","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault with an existing auth method using auth/\u003cmount\u003e/login","description_kind":"plain"},"max_items":1},"auth_login_aws":{"nesting_mode":"list","block":{"attributes":{"aws_access_key_id":{"type":"string","description":"The AWS access key ID.","description_kind":"plain","optional":true},"aws_iam_endpoint":{"type":"string","description":"The IAM endpoint URL.","description_kind":"plain","optional":true},"aws_profile":{"type":"string","description":"The name of the AWS profile.","description_kind":"plain","optional":true},"aws_region":{"type":"string","description":"The AWS region.","description_kind":"plain","optional":true},"aws_role_arn":{"type":"string","description":"The ARN of the AWS Role to assume.Used during STS AssumeRole","description_kind":"plain","optional":true},"aws_role_session_name":{"type":"string","description":"Specifies the name to attach to the AWS role session. Used during STS AssumeRole","description_kind":"plain","optional":true},"aws_secret_access_key":{"type":"string","description":"The AWS secret access key.","description_kind":"plain","optional":true},"aws_session_token":{"type":"string","description":"The AWS session token.","description_kind":"plain","optional":true},"aws_shared_credentials_file":{"type":"string","description":"Path to the AWS shared credentials file.","description_kind":"plain","optional":true},"aws_sts_endpoint":{"type":"string","description":"The STS endpoint URL.","description_kind":"plain","optional":true},"aws_web_identity_token_file":{"type":"string","description":"Path to the file containing an OAuth 2.0 access token or OpenID Connect ID token.","description_kind":"plain","optional":true},"header_value":{"type":"string","description":"The Vault header value to include in the STS signing request.","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"role":{"type":"string","description":"The Vault role to use when logging into Vault.","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the AWS method","description_kind":"plain"},"max_items":1},"auth_login_azure":{"nesting_mode":"list","block":{"attributes":{"client_id":{"type":"string","description":"The identity's client ID.","description_kind":"plain","optional":true},"jwt":{"type":"string","description":"A signed JSON Web Token. If not specified on will be created automatically","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"resource_group_name":{"type":"string","description":"The resource group for the machine that generated the MSI token. This information can be obtained through instance metadata.","description_kind":"plain","required":true},"role":{"type":"string","description":"Name of the login role.","description_kind":"plain","required":true},"scope":{"type":"string","description":"The scopes to include in the token request.","description_kind":"plain","optional":true},"subscription_id":{"type":"string","description":"The subscription ID for the machine that generated the MSI token. This information can be obtained through instance metadata.","description_kind":"plain","required":true},"tenant_id":{"type":"string","description":"Provides the tenant ID to use in a multi-tenant authentication scenario.","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true},"vm_name":{"type":"string","description":"The virtual machine name for the machine that generated the MSI token. This information can be obtained through instance metadata.","description_kind":"plain","optional":true},"vmss_name":{"type":"string","description":"The virtual machine scale set name for the machine that generated the MSI token. This information can be obtained through instance metadata.","description_kind":"plain","optional":true}},"description":"Login to vault using the azure method","description_kind":"plain"},"max_items":1},"auth_login_cert":{"nesting_mode":"list","block":{"attributes":{"cert_file":{"type":"string","description":"Path to a file containing the client certificate.","description_kind":"plain","required":true},"key_file":{"type":"string","description":"Path to a file containing the private key that the certificate was issued for.","description_kind":"plain","required":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the certificate's role","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the cert method","description_kind":"plain"},"max_items":1},"auth_login_gcp":{"nesting_mode":"list","block":{"attributes":{"credentials":{"type":"string","description":"Path to the Google Cloud credentials file.","description_kind":"plain","optional":true},"jwt":{"type":"string","description":"A signed JSON Web Token.","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the login role.","description_kind":"plain","required":true},"service_account":{"type":"string","description":"IAM service account.","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the gcp method","description_kind":"plain"},"max_items":1},"auth_login_jwt":{"nesting_mode":"list","block":{"attributes":{"jwt":{"type":"string","description":"A signed JSON Web Token.","description_kind":"plain","required":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the login role.","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the jwt method","description_kind":"plain"},"max_items":1},"auth_login_kerberos":{"nesting_mode":"list","block":{"attributes":{"disable_fast_negotiation":{"type":"bool","description":"Disable the Kerberos FAST negotiation.","description_kind":"plain","optional":true},"keytab_path":{"type":"string","description":"The Kerberos keytab file containing the entry of the login entity.","description_kind":"plain","optional":true},"krb5conf_path":{"type":"string","description":"A valid Kerberos configuration file e.g. /etc/krb5.conf.","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"realm":{"type":"string","description":"The Kerberos server's authoritative authentication domain","description_kind":"plain","optional":true},"remove_instance_name":{"type":"bool","description":"Strip the host from the username found in the keytab.","description_kind":"plain","optional":true},"service":{"type":"string","description":"The service principle name.","description_kind":"plain","optional":true},"token":{"type":"string","description":"Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) token","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true},"username":{"type":"string","description":"The username to login into Kerberos with.","description_kind":"plain","optional":true}},"description":"Login to vault using the kerberos method","description_kind":"plain"},"max_items":1},"auth_login_oci":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Authentication type to use when getting OCI credentials.","description_kind":"plain","required":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the login role.","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the OCI method","description_kind":"plain"},"max_items":1},"auth_login_oidc":{"nesting_mode":"list","block":{"attributes":{"callback_address":{"type":"string","description":"The callback address. Must be a valid URI without the path.","description_kind":"plain","optional":true},"callback_listener_address":{"type":"string","description":"The callback listener's address. Must be a valid URI without the path.","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the login role.","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using the oidc method","description_kind":"plain"},"max_items":1},"auth_login_radius":{"nesting_mode":"list","block":{"attributes":{"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"password":{"type":"string","description":"The Radius password for username.","description_kind":"plain","required":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true},"username":{"type":"string","description":"The Radius username.","description_kind":"plain","required":true}},"description":"Login to vault using the radius method","description_kind":"plain"},"max_items":1},"auth_login_token_file":{"nesting_mode":"list","block":{"attributes":{"filename":{"type":"string","description":"The name of a file containing a single line that is a valid Vault token","description_kind":"plain","required":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true}},"description":"Login to vault using ","description_kind":"plain"},"max_items":1},"auth_login_userpass":{"nesting_mode":"list","block":{"attributes":{"mount":{"type":"string","description":"The path where the authentication engine is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"The authentication engine's namespace. Conflicts with use_root_namespace","description_kind":"plain","optional":true},"password":{"type":"string","description":"Login with password","description_kind":"plain","optional":true},"password_file":{"type":"string","description":"Login with password from a file","description_kind":"plain","optional":true},"use_root_namespace":{"type":"bool","description":"Authenticate to the root Vault namespace. Conflicts with namespace","description_kind":"plain","optional":true},"username":{"type":"string","description":"Login with username","description_kind":"plain","required":true}},"description":"Login to vault using the userpass method","description_kind":"plain"},"max_items":1},"client_auth":{"nesting_mode":"list","block":{"attributes":{"cert_file":{"type":"string","description":"Path to a file containing the client certificate.","description_kind":"plain","optional":true},"key_file":{"type":"string","description":"Path to a file containing the private key that the certificate was issued for.","description_kind":"plain","optional":true}},"description":"Client authentication credentials.","description_kind":"plain","deprecated":true},"max_items":1},"headers":{"nesting_mode":"list","block":{"attributes":{"name":{"type":"string","description":"The header name","description_kind":"plain","required":true},"value":{"type":"string","description":"The header value","description_kind":"plain","required":true}},"description":"The headers to send with each Vault request.","description_kind":"plain"}}},"description_kind":"plain"}},"resource_schemas":{"vault_ad_secret_backend":{"version":1,"block":{"attributes":{"anonymous_group_search":{"type":"bool","description":"Use anonymous binds when performing LDAP group searches (if true the initial credentials will still be used for the initial connection test).","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The mount path for a backend, for example, the path given in \"$ vault auth enable -path=my-ad ad\".","description_kind":"plain","optional":true},"binddn":{"type":"string","description":"Distinguished name of object to bind when performing user and group search.","description_kind":"plain","required":true},"bindpass":{"type":"string","description":"LDAP password for searching for the user DN.","description_kind":"plain","required":true,"sensitive":true},"case_sensitive_names":{"type":"bool","description":"If true, case sensitivity will be used when comparing usernames and groups for matching policies.","description_kind":"plain","optional":true},"certificate":{"type":"string","description":"CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.","description_kind":"plain","optional":true},"client_tls_cert":{"type":"string","description":"Client certificate to provide to the LDAP server, must be x509 PEM encoded.","description_kind":"plain","optional":true,"sensitive":true},"client_tls_key":{"type":"string","description":"Client certificate key to provide to the LDAP server, must be x509 PEM encoded.","description_kind":"plain","optional":true,"sensitive":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true,"computed":true},"deny_null_bind":{"type":"bool","description":"Denies an unauthenticated LDAP bind request if the user's password is empty; defaults to true","description_kind":"plain","optional":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"discoverdn":{"type":"bool","description":"Use anonymous bind to discover the bind DN of a user.","description_kind":"plain","optional":true},"formatter":{"type":"string","description":"Text to insert the password into, ex. \"customPrefix{{PASSWORD}}customSuffix\".","description_kind":"plain","deprecated":true,"optional":true,"computed":true},"groupattr":{"type":"string","description":"LDAP attribute to follow on objects returned by \u003cgroupfilter\u003e in order to enumerate user group membership. Examples: \"cn\" or \"memberOf\", etc. Default: cn","description_kind":"plain","optional":true},"groupdn":{"type":"string","description":"LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org)","description_kind":"plain","optional":true},"groupfilter":{"type":"string","description":"Go template for querying group membership of user. The template can access the following context variables: UserDN, Username Example: (\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}})) Default: (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"insecure_tls":{"type":"bool","description":"Skip LDAP server SSL Certificate verification - insecure and not recommended for production use.","description_kind":"plain","optional":true},"last_rotation_tolerance":{"type":"number","description":"The number of seconds after a Vault rotation where, if Active Directory shows a later rotation, it should be considered out-of-band.","description_kind":"plain","optional":true,"computed":true},"length":{"type":"number","description":"The desired length of passwords that Vault generates.","description_kind":"plain","deprecated":true,"optional":true,"computed":true},"local":{"type":"bool","description":"Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration to use when checking the last rotation time.","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds.","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"In seconds, the maximum password time-to-live.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"password_policy":{"type":"string","description":"Name of the password policy to use to generate passwords.","description_kind":"plain","optional":true},"request_timeout":{"type":"number","description":"Timeout, in seconds, for the connection when making requests against the server before returning back an error.","description_kind":"plain","optional":true},"starttls":{"type":"bool","description":"Issue a StartTLS command after establishing unencrypted connection.","description_kind":"plain","optional":true,"computed":true},"tls_max_version":{"type":"string","description":"Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'","description_kind":"plain","optional":true,"computed":true},"tls_min_version":{"type":"string","description":"Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'","description_kind":"plain","optional":true,"computed":true},"ttl":{"type":"number","description":"In seconds, the default password time-to-live.","description_kind":"plain","optional":true,"computed":true},"upndomain":{"type":"string","description":"Enables userPrincipalDomain login with [username]@UPNDomain.","description_kind":"plain","optional":true,"computed":true},"url":{"type":"string","description":"LDAP URL to connect to (default: ldap://127.0.0.1). Multiple URLs can be specified by concatenating them with commas; they will be tried in-order.","description_kind":"plain","optional":true},"use_pre111_group_cn_behavior":{"type":"bool","description":"In Vault 1.1.1 a fix for handling group CN values of different cases unfortunately introduced a regression that could cause previously defined groups to not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for matching group CNs will be used. This is only needed in some upgrade scenarios for backwards compatibility. It is enabled by default if the config is upgraded but disabled by default on new configurations.","description_kind":"plain","optional":true,"computed":true},"use_token_groups":{"type":"bool","description":"If true, use the Active Directory tokenGroups constructed attribute of the user to find the group memberships. This will find all security groups including nested ones.","description_kind":"plain","optional":true},"userattr":{"type":"string","description":"Attribute used for users (default: cn)","description_kind":"plain","optional":true},"userdn":{"type":"string","description":"LDAP domain to use for users (eg: ou=People,dc=example,dc=org)","description_kind":"plain","optional":true}},"description_kind":"plain","deprecated":true}},"vault_ad_secret_library":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The mount path for the AD backend.","description_kind":"plain","required":true},"disable_check_in_enforcement":{"type":"bool","description":"Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"The maximum amount of time, in seconds, a check-out last with renewal before Vault automatically checks it back in.","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the set of service accounts.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"service_account_names":{"type":["list","string"],"description":"The names of all the service accounts that can be checked out from this set. These service accounts must already exist in Active Directory.","description_kind":"plain","required":true},"ttl":{"type":"number","description":"The amount of time, in seconds, a single check-out lasts before Vault automatically checks it back in.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain","deprecated":true}},"vault_ad_secret_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The mount path for the AD backend.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"last_vault_rotation":{"type":"string","description":"Last time Vault rotated this service account's password.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"password_last_set":{"type":"string","description":"Last time Vault set this service account's password.","description_kind":"plain","computed":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"service_account_name":{"type":"string","description":"The username/logon name for the service account with which this role will be associated.","description_kind":"plain","required":true},"ttl":{"type":"number","description":"In seconds, the default password time-to-live.","description_kind":"plain","optional":true}},"description_kind":"plain","deprecated":true}},"vault_alicloud_auth_backend_role":{"version":0,"block":{"attributes":{"arn":{"type":"string","description":"The role's arn.","description_kind":"plain","required":true},"backend":{"type":"string","description":"Auth backend.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role. Must correspond with the name of the role reflected in the arn.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_approle_auth_backend_login":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor for the token.","description_kind":"plain","computed":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"client_token":{"type":"string","description":"The token.","description_kind":"plain","computed":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"How long the token is valid for.","description_kind":"plain","computed":true},"lease_started":{"type":"string","description":"The timestamp the lease started on, as determined by the machine running Terraform.","description_kind":"plain","computed":true},"metadata":{"type":["map","string"],"description":"Metadata associated with the token.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["list","string"],"description":"Policies set on the token.","description_kind":"plain","computed":true},"renewable":{"type":"bool","description":"Whether the token is renewable or not.","description_kind":"plain","computed":true},"role_id":{"type":"string","description":"The RoleID to log in with.","description_kind":"plain","required":true},"secret_id":{"type":"string","description":"The SecretID to log in with.","description_kind":"plain","optional":true,"sensitive":true}},"description_kind":"plain"}},"vault_approle_auth_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"bind_secret_id":{"type":"bool","description":"Whether or not to require secret_id to be present when logging in using this AppRole.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_id":{"type":"string","description":"The RoleID of the role. Autogenerated if not set.","description_kind":"plain","optional":true,"computed":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"secret_id_bound_cidrs":{"type":["set","string"],"description":"List of CIDR blocks that can log in using the AppRole.","description_kind":"plain","optional":true},"secret_id_num_uses":{"type":"number","description":"Number of times which a particular SecretID can be used to fetch a token from this AppRole, after which the SecretID will expire. Leaving this unset or setting it to 0 will allow unlimited uses.","description_kind":"plain","optional":true},"secret_id_ttl":{"type":"number","description":"Number of seconds a SecretID remains valid for.","description_kind":"plain","optional":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_approle_auth_backend_role_secret_id":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"The unique ID used to access this SecretID.","description_kind":"plain","computed":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"cidr_list":{"type":["set","string"],"description":"List of CIDR blocks that can log in using the SecretID.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"metadata":{"type":"string","description":"JSON-encoded secret data to write.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"secret_id":{"type":"string","description":"The SecretID to be managed. If not specified, Vault auto-generates one.","description_kind":"plain","optional":true,"computed":true,"sensitive":true},"with_wrapped_accessor":{"type":"bool","description":"Use the wrapped secret-id accessor as the id of this resource. If false, a fresh secret-id will be regenerated whenever the wrapping token is expired or invalidated through unwrapping.","description_kind":"plain","optional":true},"wrapping_accessor":{"type":"string","description":"The wrapped SecretID accessor.","description_kind":"plain","computed":true},"wrapping_token":{"type":"string","description":"The wrapped SecretID token.","description_kind":"plain","computed":true,"sensitive":true},"wrapping_ttl":{"type":"string","description":"The TTL duration of the wrapped SecretID.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_audit":{"version":0,"block":{"attributes":{"description":{"type":"string","description":"Human-friendly description of the audit device.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the audit device is a local only. Local audit devices are not replicated nor (if a secondary) removed by replication.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"Configuration options to pass to the audit device itself.","description_kind":"plain","required":true},"path":{"type":"string","description":"Path in which to enable the audit device.","description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of the audit device, such as 'file'.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_audit_request_header":{"version":0,"block":{"attributes":{"hmac":{"type":"bool","description":"Whether this header's value should be HMAC'd in the audit logs.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the request header to audit.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor of the auth backend","description_kind":"plain","computed":true},"description":{"type":"string","description":"The description of the auth backend","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the auth method is local only","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"path to mount the backend. This defaults to the type.","description_kind":"plain","optional":true,"computed":true},"tune":{"type":["set",["object",{"allowed_response_headers":["list","string"],"audit_non_hmac_request_keys":["list","string"],"audit_non_hmac_response_keys":["list","string"],"default_lease_ttl":"string","listing_visibility":"string","max_lease_ttl":"string","passthrough_request_headers":["list","string"],"token_type":"string"}]],"description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Name of the auth backend","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_aws_auth_backend_cert":{"version":0,"block":{"attributes":{"aws_public_cert":{"type":"string","description":"Base64 encoded AWS Public key required to verify PKCS7 signature of the EC2 instance metadata.","description_kind":"plain","required":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"cert_name":{"type":"string","description":"Name of the certificate to configure.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"type":{"type":"string","description":"The type of document that can be verified using the certificate. Must be either \"pkcs7\" or \"identity\".","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_client":{"version":0,"block":{"attributes":{"access_key":{"type":"string","description":"AWS Access key with permissions to query AWS APIs.","description_kind":"plain","optional":true,"sensitive":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"ec2_endpoint":{"type":"string","description":"URL to override the default generated endpoint for making AWS EC2 API calls.","description_kind":"plain","optional":true},"iam_endpoint":{"type":"string","description":"URL to override the default generated endpoint for making AWS IAM API calls.","description_kind":"plain","optional":true},"iam_server_id_header_value":{"type":"string","description":"The value to require in the X-Vault-AWS-IAM-Server-ID header as part of GetCallerIdentity requests that are used in the iam auth method.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"AWS Secret key with permissions to query AWS APIs.","description_kind":"plain","optional":true,"sensitive":true},"sts_endpoint":{"type":"string","description":"URL to override the default generated endpoint for making AWS STS API calls.","description_kind":"plain","optional":true},"sts_region":{"type":"string","description":"Region to override the default region for making AWS STS API calls.","description_kind":"plain","optional":true},"use_sts_region_from_client":{"type":"bool","description":"If set, will override sts_region and use the region from the client request's header","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_aws_auth_backend_config_identity":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"ec2_alias":{"type":"string","description":"Configures how to generate the identity alias when using the ec2 auth method.","description_kind":"plain","optional":true},"ec2_metadata":{"type":["set","string"],"description":"The metadata to include on the token returned by the login endpoint.","description_kind":"plain","optional":true},"iam_alias":{"type":"string","description":"How to generate the identity alias when using the iam auth method.","description_kind":"plain","optional":true},"iam_metadata":{"type":["set","string"],"description":"The metadata to include on the token returned by the login endpoint.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_identity_whitelist":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"disable_periodic_tidy":{"type":"bool","description":"If true, disables the periodic tidying of the identiy whitelist entries.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"safety_buffer":{"type":"number","description":"The amount of extra time that must have passed beyond the roletag expiration, before it's removed from backend storage.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_login":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor returned from Vault for this token.","description_kind":"plain","computed":true},"auth_type":{"type":"string","description":"The auth method used to generate this token.","description_kind":"plain","computed":true},"backend":{"type":"string","description":"AWS Auth Backend to read the token from.","description_kind":"plain","optional":true},"client_token":{"type":"string","description":"The token returned by Vault.","description_kind":"plain","computed":true,"sensitive":true},"iam_http_request_method":{"type":"string","description":"The HTTP method used in the signed request.","description_kind":"plain","optional":true},"iam_request_body":{"type":"string","description":"The Base64-encoded body of the signed request.","description_kind":"plain","optional":true},"iam_request_headers":{"type":"string","description":"The Base64-encoded, JSON serialized representation of the sts:GetCallerIdentity HTTP request headers.","description_kind":"plain","optional":true},"iam_request_url":{"type":"string","description":"The Base64-encoded HTTP URL used in the signed request.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"identity":{"type":"string","description":"Base64-encoded EC2 instance identity document to authenticate with.","description_kind":"plain","optional":true},"lease_duration":{"type":"number","description":"Lease duration in seconds relative to the time in lease_start_time.","description_kind":"plain","computed":true},"lease_start_time":{"type":"string","description":"Time at which the lease was read, using the clock of the system where Terraform was running","description_kind":"plain","computed":true},"metadata":{"type":["map","string"],"description":"The metadata reported by the Vault server.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"nonce":{"type":"string","description":"The nonce to be used for subsequent login requests.","description_kind":"plain","optional":true,"computed":true},"pkcs7":{"type":"string","description":"PKCS7 signature of the identity document to authenticate with, with all newline characters removed.","description_kind":"plain","optional":true},"policies":{"type":["list","string"],"description":"The policies assigned to this token.","description_kind":"plain","computed":true},"renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"role":{"type":"string","description":"AWS Auth Role to read the token from.","description_kind":"plain","optional":true,"computed":true},"signature":{"type":"string","description":"Base64-encoded SHA256 RSA signature of the instance identtiy document to authenticate with.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_role":{"version":0,"block":{"attributes":{"allow_instance_migration":{"type":"bool","description":"When true, allows migration of the underlying instance where the client resides. Use with caution.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"The auth type permitted for this role.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"bound_account_ids":{"type":["set","string"],"description":"Only EC2 instances with this account ID in their identity document will be permitted to log in.","description_kind":"plain","optional":true},"bound_ami_ids":{"type":["set","string"],"description":"Only EC2 instances using this AMI ID will be permitted to log in.","description_kind":"plain","optional":true},"bound_ec2_instance_ids":{"type":["set","string"],"description":"Only EC2 instances that match this instance ID will be permitted to log in.","description_kind":"plain","optional":true},"bound_iam_instance_profile_arns":{"type":["set","string"],"description":"Only EC2 instances associated with an IAM instance profile ARN that matches this value will be permitted to log in.","description_kind":"plain","optional":true},"bound_iam_principal_arns":{"type":["set","string"],"description":"The IAM principal that must be authenticated using the iam auth method.","description_kind":"plain","optional":true},"bound_iam_role_arns":{"type":["set","string"],"description":"Only EC2 instances that match this IAM role ARN will be permitted to log in.","description_kind":"plain","optional":true},"bound_regions":{"type":["set","string"],"description":"Only EC2 instances in this region will be permitted to log in.","description_kind":"plain","optional":true},"bound_subnet_ids":{"type":["set","string"],"description":"Only EC2 instances associated with this subnet ID will be permitted to log in.","description_kind":"plain","optional":true},"bound_vpc_ids":{"type":["set","string"],"description":"Only EC2 instances associated with this VPC ID will be permitted to log in.","description_kind":"plain","optional":true},"disallow_reauthentication":{"type":"bool","description":"When true, only allows a single token to be granted per instance ID.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"inferred_aws_region":{"type":"string","description":"The region to search for the inferred entities in.","description_kind":"plain","optional":true},"inferred_entity_type":{"type":"string","description":"The type of inferencing Vault should do.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"resolve_aws_unique_ids":{"type":"bool","description":"Whether or not Vault should resolve the bound_iam_principal_arn to an AWS Unique ID. When true, deleting a principal and recreating it with the same name won't automatically grant the new principal the same roles in Vault that the old principal had.","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"role_id":{"type":"string","description":"The Vault generated role ID.","description_kind":"plain","computed":true},"role_tag":{"type":"string","description":"The key of the tag on EC2 instance to use for role tags.","description_kind":"plain","optional":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_role_tag":{"version":0,"block":{"attributes":{"allow_instance_migration":{"type":"bool","description":"Allows migration of the underlying instance where the client resides.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"AWS auth backend to read tags from.","description_kind":"plain","optional":true},"disallow_reauthentication":{"type":"bool","description":"Only allow a single token to be granted per instance ID.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"instance_id":{"type":"string","description":"Instance ID for which this tag is intended. The created tag can only be used by the instance with the given ID.","description_kind":"plain","optional":true},"max_ttl":{"type":"string","description":"The maximum allowed lifetime of tokens issued using this role.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"Policies to be associated with the tag.","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"tag_key":{"type":"string","description_kind":"plain","computed":true},"tag_value":{"type":"string","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_aws_auth_backend_roletag_blacklist":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","required":true},"disable_periodic_tidy":{"type":"bool","description":"If true, disables the periodic tidying of the roletag blacklist entries.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"safety_buffer":{"type":"number","description":"The amount of extra time that must have passed beyond the roletag expiration, before it's removed from backend storage.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_auth_backend_sts_role":{"version":0,"block":{"attributes":{"account_id":{"type":"string","description":"AWS account ID to be associated with STS role.","description_kind":"plain","required":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"sts_role":{"type":"string","description":"AWS ARN for STS role to be assumed when interacting with the account specified.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_aws_secret_backend":{"version":1,"block":{"attributes":{"access_key":{"type":"string","description":"The AWS Access Key ID to use when generating new credentials.","description_kind":"plain","optional":true,"sensitive":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"iam_endpoint":{"type":"string","description":"Specifies a custom HTTP IAM endpoint to use.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"identity_token_audience":{"type":"string","description":"The audience claim value.","description_kind":"plain","optional":true},"identity_token_key":{"type":"string","description":"The key to use for signing identity tokens.","description_kind":"plain","optional":true},"identity_token_ttl":{"type":"number","description":"The TTL of generated identity tokens in seconds.","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the secret backend is local only","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to mount the backend at.","description_kind":"plain","optional":true},"region":{"type":"string","description":"The AWS region to make API calls against. Defaults to us-east-1.","description_kind":"plain","optional":true,"computed":true},"role_arn":{"type":"string","description":"Role ARN to assume for plugin identity token federation.","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"The AWS Secret Access Key to use when generating new credentials.","description_kind":"plain","optional":true,"sensitive":true},"sts_endpoint":{"type":"string","description":"Specifies a custom HTTP STS endpoint to use.","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_aws_secret_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the AWS Secret Backend the role belongs to.","description_kind":"plain","required":true},"credential_type":{"type":"string","description":"Role credential type.","description_kind":"plain","required":true},"default_sts_ttl":{"type":"number","description":"The default TTL in seconds for STS credentials. When a TTL is not specified when STS credentials are requested, and a default TTL is specified on the role, then this default TTL will be used. Valid only when credential_type is one of assumed_role or federation_token.","description_kind":"plain","optional":true,"computed":true},"iam_groups":{"type":["set","string"],"description":"A list of IAM group names. IAM users generated against this vault role will be added to these IAM Groups. For a credential type of assumed_role or federation_token, the policies sent to the corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the policies from each group in iam_groups combined with the policy_document and policy_arns parameters.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_sts_ttl":{"type":"number","description":"The max allowed TTL in seconds for STS credentials (credentials TTL are capped to max_sts_ttl). Valid only when credential_type is one of assumed_role or federation_token.","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name for the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"permissions_boundary_arn":{"type":"string","description":"The ARN of the AWS Permissions Boundary to attach to IAM users created in the role. Valid only when credential_type is iam_user. If not specified, then no permissions boundary policy will be attached.","description_kind":"plain","optional":true},"policy_arns":{"type":["set","string"],"description":"ARN for an existing IAM policy the role should use.","description_kind":"plain","optional":true},"policy_document":{"type":"string","description":"IAM policy the role should use in JSON format.","description_kind":"plain","optional":true},"role_arns":{"type":["set","string"],"description":"ARNs of AWS roles allowed to be assumed. Only valid when credential_type is 'assumed_role'","description_kind":"plain","optional":true},"user_path":{"type":"string","description":"The path for the user name. Valid only when credential_type is iam_user. Default is /","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_secret_backend_static_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path where the AWS secrets backend is mounted.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"rotation_period":{"type":"number","description":"How often Vault should rotate the password of the user entry.","description_kind":"plain","required":true},"username":{"type":"string","description":"The username of the existing AWS IAM user to manage password rotation for.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_azure_auth_backend_config":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"client_id":{"type":"string","description":"The client id for credentials to query the Azure APIs. Currently read permissions to query compute resources are required.","description_kind":"plain","optional":true,"sensitive":true},"client_secret":{"type":"string","description":"The client secret for credentials to query the Azure APIs","description_kind":"plain","optional":true,"sensitive":true},"environment":{"type":"string","description":"The Azure cloud environment. Valid values: AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"resource":{"type":"string","description":"The configured URL for the application registered in Azure Active Directory.","description_kind":"plain","required":true},"tenant_id":{"type":"string","description":"The tenant id for the Azure Active Directory organization.","description_kind":"plain","required":true,"sensitive":true}},"description_kind":"plain"}},"vault_azure_auth_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"bound_group_ids":{"type":["list","string"],"description":"The list of group ids that login is restricted to.","description_kind":"plain","optional":true},"bound_locations":{"type":["list","string"],"description":"The list of locations that login is restricted to.","description_kind":"plain","optional":true},"bound_resource_groups":{"type":["list","string"],"description":"The list of resource groups that login is restricted to.","description_kind":"plain","optional":true},"bound_scale_sets":{"type":["list","string"],"description":"The list of scale set names that the login is restricted to.","description_kind":"plain","optional":true},"bound_service_principal_ids":{"type":["list","string"],"description":"The list of Service Principal IDs that login is restricted to.","description_kind":"plain","optional":true},"bound_subscription_ids":{"type":["list","string"],"description":"The list of subscription IDs that login is restricted to.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_azure_secret_backend":{"version":1,"block":{"attributes":{"client_id":{"type":"string","description":"The client id for credentials to query the Azure APIs. Currently read permissions to query compute resources are required.","description_kind":"plain","optional":true,"sensitive":true},"client_secret":{"type":"string","description":"The client secret for credentials to query the Azure APIs","description_kind":"plain","optional":true,"sensitive":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"environment":{"type":"string","description":"The Azure cloud environment. Valid values: AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to mount the backend at.","description_kind":"plain","optional":true},"subscription_id":{"type":"string","description":"The subscription id for the Azure Active Directory.","description_kind":"plain","required":true,"sensitive":true},"tenant_id":{"type":"string","description":"The tenant id for the Azure Active Directory organization.","description_kind":"plain","required":true,"sensitive":true},"use_microsoft_graph_api":{"type":"bool","description":"Use the Microsoft Graph API. Should be set to true on vault-1.10+","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_azure_secret_backend_role":{"version":0,"block":{"attributes":{"application_object_id":{"type":"string","description":"Application Object ID for an existing service principal that will be used instead of creating dynamic service principals.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"permanently_delete":{"type":"bool","description":"Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire.","description_kind":"plain","optional":true,"computed":true},"role":{"type":"string","description":"Name of the role to create","description_kind":"plain","required":true},"sign_in_audience":{"type":"string","description":"Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount","description_kind":"plain","optional":true},"tags":{"type":["list","string"],"description":"Comma-separated strings of Azure tags to attach to an application.","description_kind":"plain","optional":true},"ttl":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true}},"block_types":{"azure_groups":{"nesting_mode":"set","block":{"attributes":{"group_name":{"type":"string","description_kind":"plain","required":true},"object_id":{"type":"string","description_kind":"plain","computed":true}},"description_kind":"plain"}},"azure_roles":{"nesting_mode":"set","block":{"attributes":{"role_id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"role_name":{"type":"string","description_kind":"plain","optional":true,"computed":true},"scope":{"type":"string","description_kind":"plain","required":true}},"description_kind":"plain"}}},"description_kind":"plain"}},"vault_cert_auth_backend_role":{"version":1,"block":{"attributes":{"allowed_common_names":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"allowed_dns_sans":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"allowed_email_sans":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"allowed_names":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"allowed_organization_units":{"type":["set","string"],"description_kind":"plain","deprecated":true,"optional":true,"computed":true},"allowed_organizational_units":{"type":["set","string"],"description_kind":"plain","optional":true},"allowed_uri_sans":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"backend":{"type":"string","description_kind":"plain","optional":true},"certificate":{"type":"string","description_kind":"plain","required":true},"display_name":{"type":"string","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"ocsp_ca_certificates":{"type":"string","description":"Any additional CA certificates needed to verify OCSP responses. Provided as base64 encoded PEM data.","description_kind":"plain","optional":true},"ocsp_enabled":{"type":"bool","description":"If enabled, validate certificates' revocation status using OCSP.","description_kind":"plain","optional":true,"computed":true},"ocsp_fail_open":{"type":"bool","description":"If true and an OCSP response cannot be fetched or is of an unknown status, the login will proceed as if the certificate has not been revoked.","description_kind":"plain","optional":true,"computed":true},"ocsp_query_all_servers":{"type":"bool","description":"If set to true, rather than accepting the first successful OCSP response, query all servers and consider the certificate valid only if all servers agree.","description_kind":"plain","optional":true,"computed":true},"ocsp_servers_override":{"type":["set","string"],"description":"A comma-separated list of OCSP server addresses. If unset, the OCSP server is determined from the AuthorityInformationAccess extension on the certificate being inspected.","description_kind":"plain","optional":true},"required_extensions":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_consul_secret_backend":{"version":1,"block":{"attributes":{"address":{"type":"string","description":"Specifies the address of the Consul instance, provided as \"host:port\" like \"127.0.0.1:8500\".","description_kind":"plain","required":true},"bootstrap":{"type":"bool","description":"Denotes a backend resource that is used to bootstrap the Consul ACL system. Only one resource may be used to bootstrap.","description_kind":"plain","optional":true},"ca_cert":{"type":"string","description":"CA certificate to use when verifying Consul server certificate, must be x509 PEM encoded.","description_kind":"plain","optional":true},"client_cert":{"type":"string","description":"Client certificate used for Consul's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_key.","description_kind":"plain","optional":true,"sensitive":true},"client_key":{"type":"string","description":"Client key used for Consul's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert.","description_kind":"plain","optional":true,"sensitive":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the secret backend is local only","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Unique name of the Vault Consul mount to configure","description_kind":"plain","optional":true},"scheme":{"type":"string","description":"Specifies the URL scheme to use. Defaults to \"http\".","description_kind":"plain","optional":true},"token":{"type":"string","description":"Specifies the Consul token to use when managing or issuing new tokens.","description_kind":"plain","optional":true,"sensitive":true}},"description_kind":"plain"}},"vault_consul_secret_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the Consul Secret Backend the role belongs to.","description_kind":"plain","optional":true},"consul_namespace":{"type":"string","description":"The Consul namespace that the token will be created in. Applicable for Vault 1.10+ and Consul 1.7+","description_kind":"plain","optional":true,"computed":true},"consul_policies":{"type":["set","string"],"description":"List of Consul policies to associate with this role","description_kind":"plain","optional":true},"consul_roles":{"type":["set","string"],"description":"Set of Consul roles to attach to the token. Applicable for Vault 1.10+ with Consul 1.5+","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Indicates that the token should not be replicated globally and instead be local to the current datacenter.","description_kind":"plain","optional":true},"max_ttl":{"type":"number","description":"Maximum TTL for leases associated with this role, in seconds.","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of an existing role against which to create this Consul credential","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"node_identities":{"type":["set","string"],"description":"Set of Consul node identities to attach to\n\t\t\t\tthe token. Applicable for Vault 1.11+ with Consul 1.8+","description_kind":"plain","optional":true},"partition":{"type":"string","description":"The Consul admin partition that the token will be created in. Applicable for Vault 1.10+ and Consul 1.11+","description_kind":"plain","optional":true,"computed":true},"policies":{"type":["list","string"],"description":"List of Consul policies to associate with this role","description_kind":"plain","optional":true},"service_identities":{"type":["set","string"],"description":"Set of Consul service identities to attach to\n\t\t\t\tthe token. Applicable for Vault 1.11+ with Consul 1.5+","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"Specifies the type of token to create when using this role. Valid values are \"client\" or \"management\".","description_kind":"plain","deprecated":true,"optional":true},"ttl":{"type":"number","description":"Specifies the TTL for this role.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_database_secret_backend_connection":{"version":0,"block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the Vault mount to configure.","description_kind":"plain","required":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"block_types":{"cassandra":{"nesting_mode":"list","block":{"attributes":{"connect_timeout":{"type":"number","description":"The number of seconds to use as a connection timeout.","description_kind":"plain","optional":true},"hosts":{"type":["list","string"],"description":"Cassandra hosts to connect to.","description_kind":"plain","optional":true},"insecure_tls":{"type":"bool","description":"Whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The password to use when authenticating with Cassandra.","description_kind":"plain","optional":true,"sensitive":true},"pem_bundle":{"type":"string","description":"Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"pem_json":{"type":"string","description":"Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"port":{"type":"number","description":"The transport port to use to connect to Cassandra.","description_kind":"plain","optional":true},"protocol_version":{"type":"number","description":"The CQL protocol version to use.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Whether to use TLS when connecting to Cassandra.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The username to use when authenticating with Cassandra.","description_kind":"plain","optional":true}},"description":"Connection parameters for the cassandra-database-plugin plugin.","description_kind":"plain"},"max_items":1},"couchbase":{"nesting_mode":"list","block":{"attributes":{"base64_pem":{"type":"string","description":"Required if `tls` is `true`. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded.","description_kind":"plain","optional":true,"sensitive":true},"bucket_name":{"type":"string","description":"Required for Couchbase versions prior to 6.5.0. This is only used to verify vault's connection to the server.","description_kind":"plain","optional":true},"hosts":{"type":["list","string"],"description":"A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":" Specifies whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"tls":{"type":"bool","description":"Specifies whether to use TLS when connecting to Couchbase.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username for Vault to use.","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true}},"description":"Connection parameters for the couchbase-database-plugin plugin.","description_kind":"plain"},"max_items":1},"elasticsearch":{"nesting_mode":"list","block":{"attributes":{"ca_cert":{"type":"string","description":"The path to a PEM-encoded CA cert file to use to verify the Elasticsearch server's identity","description_kind":"plain","optional":true},"ca_path":{"type":"string","description":"The path to a directory of PEM-encoded CA cert files to use to verify the Elasticsearch server's identity","description_kind":"plain","optional":true},"client_cert":{"type":"string","description":"The path to the certificate for the Elasticsearch client to present for communication","description_kind":"plain","optional":true},"client_key":{"type":"string","description":"The path to the key for the Elasticsearch client to use for communication","description_kind":"plain","optional":true},"insecure":{"type":"bool","description":"Whether to disable certificate verification","description_kind":"plain","optional":true},"password":{"type":"string","description":"The password to be used in the connection URL","description_kind":"plain","required":true,"sensitive":true},"tls_server_name":{"type":"string","description":"This, if set, is used to set the SNI host when connecting via TLS","description_kind":"plain","optional":true},"url":{"type":"string","description":"The URL for Elasticsearch's API","description_kind":"plain","required":true},"username":{"type":"string","description":"The username to be used in the connection URL","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true}},"description":"Connection parameters for the elasticsearch-database-plugin.","description_kind":"plain"},"max_items":1},"hana":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true}},"description":"Connection parameters for the hana-database-plugin plugin.","description_kind":"plain"},"max_items":1},"influxdb":{"nesting_mode":"list","block":{"attributes":{"connect_timeout":{"type":"number","description":"The number of seconds to use as a connection timeout.","description_kind":"plain","optional":true},"host":{"type":"string","description":"Influxdb host to connect to.","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":"Whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"pem_bundle":{"type":"string","description":"Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"pem_json":{"type":"string","description":"Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"port":{"type":"number","description":"The transport port to use to connect to Influxdb.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Whether to use TLS when connecting to Influxdb.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username to use for superuser access.","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true}},"description":"Connection parameters for the influxdb-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mongodb":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mongodb-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mongodbatlas":{"nesting_mode":"list","block":{"attributes":{"private_key":{"type":"string","description":"The Private Programmatic API Key used to connect with MongoDB Atlas API.","description_kind":"plain","required":true,"sensitive":true},"project_id":{"type":"string","description":"The Project ID the Database User should be created within.","description_kind":"plain","required":true},"public_key":{"type":"string","description":"The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.","description_kind":"plain","required":true}},"description":"Connection parameters for the mongodbatlas-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mssql":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"contained_db":{"type":"bool","description":"Set to true when the target is a Contained Database, e.g. AzureSQL.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mssql-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mysql":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mysql_aurora":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-aurora-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mysql_legacy":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-legacy-database-plugin plugin.","description_kind":"plain"},"max_items":1},"mysql_rds":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-rds-database-plugin plugin.","description_kind":"plain"},"max_items":1},"oracle":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"disconnect_sessions":{"type":"bool","description":"Set to true to disconnect any open sessions prior to running the revocation statements.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"split_statements":{"type":"bool","description":"Set to true in order to split statements after semi-colons.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the oracle-database-plugin plugin.","description_kind":"plain"},"max_items":1},"postgresql":{"nesting_mode":"list","block":{"attributes":{"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the postgresql-database-plugin plugin.","description_kind":"plain"},"max_items":1},"redis":{"nesting_mode":"list","block":{"attributes":{"ca_cert":{"type":"string","description":"The contents of a PEM-encoded CA cert file to use to verify the Redis server's identity.","description_kind":"plain","optional":true},"host":{"type":"string","description":"Specifies the host to connect to","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":"Specifies whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"port":{"type":"number","description":"The transport port to use to connect to Redis.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Specifies whether to use TLS when connecting to Redis.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username for Vault to use.","description_kind":"plain","required":true}},"description":"Connection parameters for the redis-database-plugin plugin.","description_kind":"plain"},"max_items":1},"redis_elasticache":{"nesting_mode":"list","block":{"attributes":{"password":{"type":"string","description":"The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.","description_kind":"plain","optional":true,"sensitive":true},"region":{"type":"string","description":"The AWS region where the ElastiCache cluster is hosted. If omitted the plugin tries to infer the region from the environment.","description_kind":"plain","optional":true},"url":{"type":"string","description":"The configuration endpoint for the ElastiCache cluster to connect to.","description_kind":"plain","required":true},"username":{"type":"string","description":"The AWS access key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.","description_kind":"plain","optional":true,"sensitive":true}},"description":"Connection parameters for the redis-elasticache-database-plugin plugin.","description_kind":"plain"},"max_items":1},"redshift":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the redshift-database-plugin plugin.","description_kind":"plain"},"max_items":1},"snowflake":{"nesting_mode":"list","block":{"attributes":{"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true}},"description":"Connection parameters for the snowflake-database-plugin plugin.","description_kind":"plain"},"max_items":1}},"description_kind":"plain"}},"vault_database_secret_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the Database Secret Backend the role belongs to.","description_kind":"plain","required":true},"creation_statements":{"type":["list","string"],"description":"Database statements to execute to create and configure a user.","description_kind":"plain","required":true},"credential_config":{"type":["map","string"],"description":"Specifies the configuration for the given credential_type.","description_kind":"plain","optional":true},"credential_type":{"type":"string","description":"Specifies the type of credential that will be generated for the role.","description_kind":"plain","optional":true,"computed":true},"db_name":{"type":"string","description":"Database connection to use for this role.","description_kind":"plain","required":true},"default_ttl":{"type":"number","description":"Default TTL for leases associated with this role, in seconds.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"Maximum TTL for leases associated with this role, in seconds.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Unique name for the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"renew_statements":{"type":["list","string"],"description":"Database statements to execute to renew a user.","description_kind":"plain","optional":true},"revocation_statements":{"type":["list","string"],"description":"Database statements to execute to revoke a user.","description_kind":"plain","optional":true},"rollback_statements":{"type":["list","string"],"description":"Database statements to execute to rollback a create operation in the event of an error.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_database_secret_backend_static_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the Database Secret Backend the role belongs to.","description_kind":"plain","required":true},"db_name":{"type":"string","description":"Database connection to use for this role.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name for the static role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"rotation_period":{"type":"number","description":"The amount of time Vault should wait before rotating the password, in seconds.","description_kind":"plain","optional":true},"rotation_schedule":{"type":"string","description":"A cron-style string that will define the schedule on which rotations should occur.","description_kind":"plain","optional":true},"rotation_statements":{"type":["list","string"],"description":"Database statements to execute to rotate the password for the configured database user.","description_kind":"plain","optional":true},"rotation_window":{"type":"number","description":"The amount of time in seconds in which the rotations are allowed to occur starting from a given rotation_schedule.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The database username that this role corresponds to.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_database_secrets_mount":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"Accessor of the mount","description_kind":"plain","computed":true},"allowed_managed_keys":{"type":["set","string"],"description":"List of managed key registry entry names that the mount in question is allowed to access","description_kind":"plain","optional":true},"audit_non_hmac_request_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.","description_kind":"plain","optional":true,"computed":true},"audit_non_hmac_response_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.","description_kind":"plain","optional":true,"computed":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount","description_kind":"plain","optional":true},"engine_count":{"type":"number","description":"Total number of database secret engines configured under the mount.","description_kind":"plain","computed":true},"external_entropy_access":{"type":"bool","description":"Enable the secrets engine to access Vault's external entropy source","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Local mount flag that can be explicitly set to true to enforce local mount in HA environment","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"Specifies mount type specific options that are passed to the backend","description_kind":"plain","optional":true},"path":{"type":"string","description":"Where the secret backend will be mounted","description_kind":"plain","required":true},"seal_wrap":{"type":"bool","description":"Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability","description_kind":"plain","optional":true,"computed":true}},"block_types":{"cassandra":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connect_timeout":{"type":"number","description":"The number of seconds to use as a connection timeout.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"hosts":{"type":["list","string"],"description":"Cassandra hosts to connect to.","description_kind":"plain","optional":true},"insecure_tls":{"type":"bool","description":"Whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The password to use when authenticating with Cassandra.","description_kind":"plain","optional":true,"sensitive":true},"pem_bundle":{"type":"string","description":"Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"pem_json":{"type":"string","description":"Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"port":{"type":"number","description":"The transport port to use to connect to Cassandra.","description_kind":"plain","optional":true},"protocol_version":{"type":"number","description":"The CQL protocol version to use.","description_kind":"plain","optional":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Whether to use TLS when connecting to Cassandra.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The username to use when authenticating with Cassandra.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the cassandra-database-plugin plugin.","description_kind":"plain"}},"couchbase":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"base64_pem":{"type":"string","description":"Required if `tls` is `true`. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded.","description_kind":"plain","optional":true,"sensitive":true},"bucket_name":{"type":"string","description":"Required for Couchbase versions prior to 6.5.0. This is only used to verify vault's connection to the server.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"hosts":{"type":["list","string"],"description":"A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":" Specifies whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Specifies whether to use TLS when connecting to Couchbase.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username for Vault to use.","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the couchbase-database-plugin plugin.","description_kind":"plain"}},"elasticsearch":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"ca_cert":{"type":"string","description":"The path to a PEM-encoded CA cert file to use to verify the Elasticsearch server's identity","description_kind":"plain","optional":true},"ca_path":{"type":"string","description":"The path to a directory of PEM-encoded CA cert files to use to verify the Elasticsearch server's identity","description_kind":"plain","optional":true},"client_cert":{"type":"string","description":"The path to the certificate for the Elasticsearch client to present for communication","description_kind":"plain","optional":true},"client_key":{"type":"string","description":"The path to the key for the Elasticsearch client to use for communication","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"insecure":{"type":"bool","description":"Whether to disable certificate verification","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The password to be used in the connection URL","description_kind":"plain","required":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"tls_server_name":{"type":"string","description":"This, if set, is used to set the SNI host when connecting via TLS","description_kind":"plain","optional":true},"url":{"type":"string","description":"The URL for Elasticsearch's API","description_kind":"plain","required":true},"username":{"type":"string","description":"The username to be used in the connection URL","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the elasticsearch-database-plugin.","description_kind":"plain"}},"hana":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the hana-database-plugin plugin.","description_kind":"plain"}},"influxdb":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connect_timeout":{"type":"number","description":"The number of seconds to use as a connection timeout.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"host":{"type":"string","description":"Influxdb host to connect to.","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":"Whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"pem_bundle":{"type":"string","description":"Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"pem_json":{"type":"string","description":"Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"port":{"type":"number","description":"The transport port to use to connect to Influxdb.","description_kind":"plain","optional":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Whether to use TLS when connecting to Influxdb.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username to use for superuser access.","description_kind":"plain","required":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the influxdb-database-plugin plugin.","description_kind":"plain"}},"mongodb":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mongodb-database-plugin plugin.","description_kind":"plain"}},"mongodbatlas":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"private_key":{"type":"string","description":"The Private Programmatic API Key used to connect with MongoDB Atlas API.","description_kind":"plain","required":true,"sensitive":true},"project_id":{"type":"string","description":"The Project ID the Database User should be created within.","description_kind":"plain","required":true},"public_key":{"type":"string","description":"The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.","description_kind":"plain","required":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mongodbatlas-database-plugin plugin.","description_kind":"plain"}},"mssql":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"contained_db":{"type":"bool","description":"Set to true when the target is a Contained Database, e.g. AzureSQL.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mssql-database-plugin plugin.","description_kind":"plain"}},"mysql":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-database-plugin plugin.","description_kind":"plain"}},"mysql_aurora":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-aurora-database-plugin plugin.","description_kind":"plain"}},"mysql_legacy":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-legacy-database-plugin plugin.","description_kind":"plain"}},"mysql_rds":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"tls_ca":{"type":"string","description":"x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.","description_kind":"plain","optional":true},"tls_certificate_key":{"type":"string","description":"x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the mysql-rds-database-plugin plugin.","description_kind":"plain"}},"oracle":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"disconnect_sessions":{"type":"bool","description":"Set to true to disconnect any open sessions prior to running the revocation statements.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"split_statements":{"type":"bool","description":"Set to true in order to split statements after semi-colons.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the oracle-database-plugin plugin.","description_kind":"plain"}},"postgresql":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"auth_type":{"type":"string","description":"Specify alternative authorization type. (Only 'gcp_iam' is valid currently)","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"service_account_json":{"type":"string","description":"A JSON encoded credential for use with IAM authorization","description_kind":"plain","optional":true,"sensitive":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the postgresql-database-plugin plugin.","description_kind":"plain"}},"redis":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"ca_cert":{"type":"string","description":"The contents of a PEM-encoded CA cert file to use to verify the Redis server's identity.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"host":{"type":"string","description":"Specifies the host to connect to","description_kind":"plain","required":true},"insecure_tls":{"type":"bool","description":"Specifies whether to skip verification of the server certificate when using TLS.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"Specifies the password corresponding to the given username.","description_kind":"plain","required":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"port":{"type":"number","description":"The transport port to use to connect to Redis.","description_kind":"plain","optional":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"tls":{"type":"bool","description":"Specifies whether to use TLS when connecting to Redis.","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the username for Vault to use.","description_kind":"plain","required":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the redis-database-plugin plugin.","description_kind":"plain"}},"redis_elasticache":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"region":{"type":"string","description":"The AWS region where the ElastiCache cluster is hosted. If omitted the plugin tries to infer the region from the environment.","description_kind":"plain","optional":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"url":{"type":"string","description":"The configuration endpoint for the ElastiCache cluster to connect to.","description_kind":"plain","required":true},"username":{"type":"string","description":"The AWS access key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.","description_kind":"plain","optional":true,"sensitive":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the redis-elasticache-database-plugin plugin.","description_kind":"plain"}},"redshift":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"disable_escaping":{"type":"bool","description":"Disable special character escaping in username and password","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the redshift-database-plugin plugin.","description_kind":"plain"}},"snowflake":{"nesting_mode":"list","block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"A list of roles that are allowed to use this connection.","description_kind":"plain","optional":true},"connection_url":{"type":"string","description":"Connection string to use to connect to the database.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of sensitive data to pass to the endpoint. Useful for templated connection strings.","description_kind":"plain","optional":true},"max_connection_lifetime":{"type":"number","description":"Maximum number of seconds a connection may be reused.","description_kind":"plain","optional":true},"max_idle_connections":{"type":"number","description":"Maximum number of idle connections to the database.","description_kind":"plain","optional":true},"max_open_connections":{"type":"number","description":"Maximum number of open connections to the database.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the database connection.","description_kind":"plain","required":true},"password":{"type":"string","description":"The root credential password used in the connection URL","description_kind":"plain","optional":true,"sensitive":true},"plugin_name":{"type":"string","description":"Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types.","description_kind":"plain","optional":true,"computed":true},"root_rotation_statements":{"type":["list","string"],"description":"A list of database statements to be executed to rotate the root user's credentials.","description_kind":"plain","optional":true},"username":{"type":"string","description":"The root credential username used in the connection URL","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"Username generation template.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies if the connection is verified during initial configuration.","description_kind":"plain","optional":true}},"description":"Connection parameters for the snowflake-database-plugin plugin.","description_kind":"plain"}}},"description_kind":"plain"}},"vault_egp_policy":{"version":0,"block":{"attributes":{"enforcement_level":{"type":"string","description":"Enforcement level of Sentinel policy. Can be one of: 'advisory', 'soft-mandatory' or 'hard-mandatory'","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the policy","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"paths":{"type":["list","string"],"description":"List of paths to which the policy will be applied","description_kind":"plain","required":true},"policy":{"type":"string","description":"The policy document","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_gcp_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor of the auth backend","description_kind":"plain","computed":true},"client_email":{"type":"string","description_kind":"plain","optional":true,"computed":true},"client_id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"credentials":{"type":"string","description_kind":"plain","optional":true,"sensitive":true},"description":{"type":"string","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the auth method is local only","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description_kind":"plain","optional":true},"private_key_id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"project_id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"tune":{"type":["set",["object",{"allowed_response_headers":["list","string"],"audit_non_hmac_request_keys":["list","string"],"audit_non_hmac_response_keys":["list","string"],"default_lease_ttl":"string","listing_visibility":"string","max_lease_ttl":"string","passthrough_request_headers":["list","string"],"token_type":"string"}]],"description_kind":"plain","optional":true,"computed":true}},"block_types":{"custom_endpoint":{"nesting_mode":"list","block":{"attributes":{"api":{"type":"string","description":"Replaces the service endpoint used in API requests to https://www.googleapis.com.","description_kind":"plain","optional":true},"compute":{"type":"string","description":"Replaces the service endpoint used in API requests to `https://compute.googleapis.com`.","description_kind":"plain","optional":true},"crm":{"type":"string","description":"Replaces the service endpoint used in API requests to `https://cloudresourcemanager.googleapis.com`.","description_kind":"plain","optional":true},"iam":{"type":"string","description":"Replaces the service endpoint used in API requests to `https://iam.googleapis.com`.","description_kind":"plain","optional":true}},"description":"Specifies overrides to service endpoints used when making API requests to GCP.","description_kind":"plain"},"max_items":1}},"description_kind":"plain"}},"vault_gcp_auth_backend_role":{"version":1,"block":{"attributes":{"add_group_aliases":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"allow_gce_inference":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"backend":{"type":"string","description_kind":"plain","optional":true},"bound_instance_groups":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"bound_labels":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"bound_projects":{"type":["set","string"],"description_kind":"plain","optional":true},"bound_regions":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"bound_service_accounts":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"bound_zones":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_jwt_exp":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true},"type":{"type":"string","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_gcp_secret_backend":{"version":1,"block":{"attributes":{"credentials":{"type":"string","description":"JSON-encoded credentials to use to connect to GCP","description_kind":"plain","optional":true,"sensitive":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Local mount flag that can be explicitly set to true to enforce local mount in HA environment","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to mount the backend at.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_gcp_secret_impersonated_account":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Path where the GCP secrets engine is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"impersonated_account":{"type":"string","description":"Name of the Impersonated Account to create","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"service_account_email":{"type":"string","description":"Email of the GCP service account.","description_kind":"plain","required":true},"service_account_project":{"type":"string","description":"Project of the GCP Service Account managed by this impersonated account","description_kind":"plain","computed":true},"token_scopes":{"type":["set","string"],"description":"List of OAuth scopes to assign to `access_token` secrets generated under this impersonated account (`access_token` impersonated accounts only) ","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_gcp_secret_roleset":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Path where the GCP secrets engine is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"project":{"type":"string","description":"Name of the GCP project that this roleset's service account will belong to.","description_kind":"plain","required":true},"roleset":{"type":"string","description":"Name of the RoleSet to create","description_kind":"plain","required":true},"secret_type":{"type":"string","description":"Type of secret generated for this role set. Defaults to `access_token`. Accepted values: `access_token`, `service_account_key`","description_kind":"plain","optional":true,"computed":true},"service_account_email":{"type":"string","description":"Email of the service account created by Vault for this Roleset","description_kind":"plain","computed":true},"token_scopes":{"type":["set","string"],"description":"List of OAuth scopes to assign to `access_token` secrets generated under this role set (`access_token` role sets only) ","description_kind":"plain","optional":true}},"block_types":{"binding":{"nesting_mode":"set","block":{"attributes":{"resource":{"type":"string","description":"Resource name","description_kind":"plain","required":true},"roles":{"type":["set","string"],"description":"List of roles to apply to the resource","description_kind":"plain","required":true}},"description_kind":"plain"},"min_items":1}},"description_kind":"plain"}},"vault_gcp_secret_static_account":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Path where the GCP secrets engine is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_type":{"type":"string","description":"Type of secret generated for this static account. Defaults to `access_token`. Accepted values: `access_token`, `service_account_key`","description_kind":"plain","optional":true,"computed":true},"service_account_email":{"type":"string","description":"Email of the GCP service account.","description_kind":"plain","required":true},"service_account_project":{"type":"string","description":"Project of the GCP Service Account managed by this static account","description_kind":"plain","computed":true},"static_account":{"type":"string","description":"Name of the Static Account to create","description_kind":"plain","required":true},"token_scopes":{"type":["set","string"],"description":"List of OAuth scopes to assign to `access_token` secrets generated under this static account (`access_token` static accounts only) ","description_kind":"plain","optional":true}},"block_types":{"binding":{"nesting_mode":"set","block":{"attributes":{"resource":{"type":"string","description":"Resource name","description_kind":"plain","required":true},"roles":{"type":["set","string"],"description":"List of roles to apply to the resource","description_kind":"plain","required":true}},"description_kind":"plain"}}},"description_kind":"plain"}},"vault_generic_endpoint":{"version":1,"block":{"attributes":{"data_json":{"type":"string","description":"JSON-encoded data to write.","description_kind":"plain","required":true,"sensitive":true},"disable_delete":{"type":"bool","description":"Don't attempt to delete the path from Vault if true","description_kind":"plain","optional":true},"disable_read":{"type":"bool","description":"Don't attempt to read the path from Vault if true; drift won't be detected","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ignore_absent_fields":{"type":"bool","description":"When reading, disregard fields not present in data_json","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where to the endpoint that will be written","description_kind":"plain","required":true},"write_data":{"type":["map","string"],"description":"Map of strings returned by write operation","description_kind":"plain","computed":true},"write_data_json":{"type":"string","description":"JSON data returned by write operation","description_kind":"plain","computed":true},"write_fields":{"type":["list","string"],"description":"Top-level fields returned by write to persist in state","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_generic_secret":{"version":1,"block":{"attributes":{"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data to write.","description_kind":"plain","required":true,"sensitive":true},"delete_all_versions":{"type":"bool","description":"Only applicable for kv-v2 stores. If set, permanently deletes all versions for the specified key.","description_kind":"plain","optional":true},"disable_read":{"type":"bool","description":"Don't attempt to read the token from Vault if true; drift won't be detected.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where the generic secret will be written.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_github_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The mount accessor related to the auth mount.","description_kind":"plain","computed":true},"base_url":{"type":"string","description":"The API endpoint to use. Useful if you are running GitHub Enterprise or an API-compatible authentication server.","description_kind":"plain","optional":true},"description":{"type":"string","description":"Specifies the description of the mount. This overrides the current stored value, if any.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"The organization users must be part of.","description_kind":"plain","required":true},"organization_id":{"type":"number","description":"The ID of the organization users must be part of. Vault will attempt to fetch and set this value if it is not provided (vault-1.10+)","description_kind":"plain","optional":true,"computed":true},"path":{"type":"string","description":"Path where the auth backend is mounted","description_kind":"plain","optional":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true},"tune":{"type":["set",["object",{"allowed_response_headers":["list","string"],"audit_non_hmac_request_keys":["list","string"],"audit_non_hmac_response_keys":["list","string"],"default_lease_ttl":"string","listing_visibility":"string","max_lease_ttl":"string","passthrough_request_headers":["list","string"],"token_type":"string"}]],"description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_github_team":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Auth backend to which team mapping will be configured.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["list","string"],"description":"Policies to be assigned to this team.","description_kind":"plain","optional":true},"team":{"type":"string","description":"GitHub team name in \"slugified\" format.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_github_user":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Auth backend to which user mapping will be congigured.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["list","string"],"description":"Policies to be assigned to this user.","description_kind":"plain","optional":true},"user":{"type":"string","description":"GitHub user name.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_identity_entity":{"version":0,"block":{"attributes":{"disabled":{"type":"bool","description":"Whether the entity is disabled. Disabled entities' associated tokens cannot be used, but are not revoked.","description_kind":"plain","optional":true},"external_policies":{"type":"bool","description":"Manage policies externally through `vault_identity_entity_policies`.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"metadata":{"type":["map","string"],"description":"Metadata to be associated with the entity.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the entity.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"Policies to be tied to the entity.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_entity_alias":{"version":0,"block":{"attributes":{"canonical_id":{"type":"string","description":"ID of the entity to which this is an alias.","description_kind":"plain","required":true},"custom_metadata":{"type":["map","string"],"description":"Custom metadata to be associated with this alias.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount_accessor":{"type":"string","description":"Mount accessor to which this alias belongs toMount accessor to which this alias belongs to.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the entity alias.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_entity_policies":{"version":0,"block":{"attributes":{"entity_id":{"type":"string","description":"ID of the entity.","description_kind":"plain","required":true},"entity_name":{"type":"string","description":"Name of the entity.","description_kind":"plain","computed":true},"exclusive":{"type":"bool","description":"Should the resource manage policies exclusively","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"Policies to be tied to the entity.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_identity_group":{"version":1,"block":{"attributes":{"external_member_entity_ids":{"type":"bool","description":"Manage member entities externally through `vault_identity_group_member_entity_ids`","description_kind":"plain","optional":true},"external_member_group_ids":{"type":"bool","description":"Manage member groups externally through `vault_identity_group_member_group_ids`","description_kind":"plain","optional":true},"external_policies":{"type":"bool","description":"Manage policies externally through `vault_identity_group_policies`, allows using group ID in assigned policies.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"member_entity_ids":{"type":["set","string"],"description":"Entity IDs to be assigned as group members.","description_kind":"plain","optional":true},"member_group_ids":{"type":["set","string"],"description":"Group IDs to be assigned as group members.","description_kind":"plain","optional":true},"metadata":{"type":["map","string"],"description":"Metadata to be associated with the group.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the group.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"Policies to be tied to the group.","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of the group, internal or external. Defaults to internal.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_group_alias":{"version":0,"block":{"attributes":{"canonical_id":{"type":"string","description":"ID of the group to which this is an alias.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount_accessor":{"type":"string","description":"Mount accessor to which this alias belongs to.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the group alias.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_group_member_entity_ids":{"version":0,"block":{"attributes":{"exclusive":{"type":"bool","description":"If set to true, allows the resource to manage member entity ids\nexclusively. Beware of race conditions when disabling exclusive management","description_kind":"plain","optional":true},"group_id":{"type":"string","description":"ID of the group.","description_kind":"plain","required":true},"group_name":{"type":"string","description":"Name of the group.","description_kind":"plain","deprecated":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"member_entity_ids":{"type":["set","string"],"description":"Entity IDs to be assigned as group members.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_group_member_group_ids":{"version":0,"block":{"attributes":{"exclusive":{"type":"bool","description":"If set to true, allows the resource to manage member group ids\nexclusively. Beware of race conditions when disabling exclusive management","description_kind":"plain","optional":true},"group_id":{"type":"string","description":"ID of the group.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"member_group_ids":{"type":["set","string"],"description":"Group IDs to be assigned as group members.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_group_policies":{"version":0,"block":{"attributes":{"exclusive":{"type":"bool","description":"Should the resource manage policies exclusively? Beware of race conditions when disabling exclusive management","description_kind":"plain","optional":true},"group_id":{"type":"string","description":"ID of the group.","description_kind":"plain","required":true},"group_name":{"type":"string","description":"Name of the group.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"Policies to be tied to the group.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_identity_mfa_duo":{"version":0,"block":{"attributes":{"api_hostname":{"type":"string","description":"API hostname for Duo","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"integration_key":{"type":"string","description":"Integration key for Duo","description_kind":"plain","required":true,"sensitive":true},"method_id":{"type":"string","description":"Method ID.","description_kind":"plain","computed":true},"mount_accessor":{"type":"string","description":"Mount accessor.","description_kind":"plain","computed":true},"name":{"type":"string","description":"Method name.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Method's namespace ID.","description_kind":"plain","computed":true},"namespace_path":{"type":"string","description":"Method's namespace path.","description_kind":"plain","computed":true},"push_info":{"type":"string","description":"Push information for Duo.","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"Secret key for Duo","description_kind":"plain","required":true,"sensitive":true},"type":{"type":"string","description":"MFA type.","description_kind":"plain","computed":true},"use_passcode":{"type":"bool","description":"Require passcode upon MFA validation.","description_kind":"plain","optional":true},"username_format":{"type":"string","description":"A template string for mapping Identity names to MFA methods.","description_kind":"plain","optional":true},"uuid":{"type":"string","description":"Resource UUID.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_mfa_login_enforcement":{"version":0,"block":{"attributes":{"auth_method_accessors":{"type":["set","string"],"description":"Set of auth method accessor IDs.","description_kind":"plain","optional":true},"auth_method_types":{"type":["set","string"],"description":"Set of auth method types.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"identity_entity_ids":{"type":["set","string"],"description":"Set of identity entity IDs.","description_kind":"plain","optional":true},"identity_group_ids":{"type":["set","string"],"description":"Set of identity group IDs.","description_kind":"plain","optional":true},"mfa_method_ids":{"type":["set","string"],"description":"Set of MFA method UUIDs.","description_kind":"plain","required":true},"name":{"type":"string","description":"Login enforcement name.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Method's namespace ID.","description_kind":"plain","computed":true},"namespace_path":{"type":"string","description":"Method's namespace path.","description_kind":"plain","computed":true},"uuid":{"type":"string","description":"Resource UUID.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_mfa_okta":{"version":0,"block":{"attributes":{"api_token":{"type":"string","description":"Okta API token.","description_kind":"plain","required":true,"sensitive":true},"base_url":{"type":"string","description":"The base domain to use for API requests.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"method_id":{"type":"string","description":"Method ID.","description_kind":"plain","computed":true},"mount_accessor":{"type":"string","description":"Mount accessor.","description_kind":"plain","computed":true},"name":{"type":"string","description":"Method name.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Method's namespace ID.","description_kind":"plain","computed":true},"namespace_path":{"type":"string","description":"Method's namespace path.","description_kind":"plain","computed":true},"org_name":{"type":"string","description":"Name of the organization to be used in the Okta API.","description_kind":"plain","required":true},"primary_email":{"type":"bool","description":"Only match the primary email for the account.","description_kind":"plain","optional":true},"type":{"type":"string","description":"MFA type.","description_kind":"plain","computed":true},"username_format":{"type":"string","description":"A template string for mapping Identity names to MFA methods.","description_kind":"plain","optional":true},"uuid":{"type":"string","description":"Resource UUID.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_mfa_pingid":{"version":0,"block":{"attributes":{"admin_url":{"type":"string","description":"The admin URL, derived from \"settings_file_base64\"","description_kind":"plain","computed":true},"authenticator_url":{"type":"string","description":"A unique identifier of the organization, derived from \"settings_file_base64\"","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"idp_url":{"type":"string","description":"The IDP URL, derived from \"settings_file_base64\"","description_kind":"plain","computed":true},"method_id":{"type":"string","description":"Method ID.","description_kind":"plain","computed":true},"mount_accessor":{"type":"string","description":"Mount accessor.","description_kind":"plain","computed":true},"name":{"type":"string","description":"Method name.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Method's namespace ID.","description_kind":"plain","computed":true},"namespace_path":{"type":"string","description":"Method's namespace path.","description_kind":"plain","computed":true},"org_alias":{"type":"string","description":"The name of the PingID client organization, derived from \"settings_file_base64\"","description_kind":"plain","computed":true},"settings_file_base64":{"type":"string","description":"A base64-encoded third-party settings contents as retrieved from PingID's configuration page.","description_kind":"plain","required":true},"type":{"type":"string","description":"MFA type.","description_kind":"plain","computed":true},"use_signature":{"type":"bool","description":"Use signature value, derived from \"settings_file_base64\"","description_kind":"plain","computed":true},"username_format":{"type":"string","description":"A template string for mapping Identity names to MFA methods.","description_kind":"plain","optional":true},"uuid":{"type":"string","description":"Resource UUID.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_mfa_totp":{"version":0,"block":{"attributes":{"algorithm":{"type":"string","description":"Specifies the hashing algorithm used to generate the TOTP code. Options include SHA1, SHA256, SHA512.","description_kind":"plain","optional":true},"digits":{"type":"number","description":"The number of digits in the generated TOTP token. This value can either be 6 or 8","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"The name of the key's issuing organization.","description_kind":"plain","required":true},"key_size":{"type":"number","description":"Specifies the size in bytes of the generated key.","description_kind":"plain","optional":true},"max_validation_attempts":{"type":"number","description":"The maximum number of consecutive failed validation attempts allowed.","description_kind":"plain","optional":true},"method_id":{"type":"string","description":"Method ID.","description_kind":"plain","computed":true},"mount_accessor":{"type":"string","description":"Mount accessor.","description_kind":"plain","computed":true},"name":{"type":"string","description":"Method name.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Method's namespace ID.","description_kind":"plain","computed":true},"namespace_path":{"type":"string","description":"Method's namespace path.","description_kind":"plain","computed":true},"period":{"type":"number","description":"The length of time in seconds used to generate a counter for the TOTP token calculation.","description_kind":"plain","optional":true},"qr_size":{"type":"number","description":"The pixel size of the generated square QR code.","description_kind":"plain","optional":true,"computed":true},"skew":{"type":"number","description":"The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.","description_kind":"plain","optional":true},"type":{"type":"string","description":"MFA type.","description_kind":"plain","computed":true},"uuid":{"type":"string","description":"Resource UUID.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_oidc":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"Issuer URL to be used in the iss claim of the token. If not set, Vault's api_addr will be used. The issuer is a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components, but no query or fragment components.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_assignment":{"version":0,"block":{"attributes":{"entity_ids":{"type":["set","string"],"description":"A list of Vault entity IDs.","description_kind":"plain","optional":true},"group_ids":{"type":["set","string"],"description":"A list of Vault group IDs.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the assignment.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_client":{"version":0,"block":{"attributes":{"access_token_ttl":{"type":"number","description":"The time-to-live for access tokens obtained by the client.","description_kind":"plain","optional":true,"computed":true},"assignments":{"type":["set","string"],"description":"A list of assignment resources associated with the client.","description_kind":"plain","optional":true},"client_id":{"type":"string","description":"The Client ID from Vault.","description_kind":"plain","computed":true},"client_secret":{"type":"string","description":"The Client Secret from Vault.","description_kind":"plain","computed":true,"sensitive":true},"client_type":{"type":"string","description":"The client type based on its ability to maintain confidentiality of credentials.Defaults to 'confidential'.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"id_token_ttl":{"type":"number","description":"The time-to-live for ID tokens obtained by the client. The value should be less than the verification_ttl on the key.","description_kind":"plain","optional":true,"computed":true},"key":{"type":"string","description":"A reference to a named key resource in Vault. This cannot be modified after creation.","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the client.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"redirect_uris":{"type":["set","string"],"description":"Redirection URI values used by the client. One of these values must exactly match the redirect_uri parameter value used in each authentication request.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_key":{"version":0,"block":{"attributes":{"algorithm":{"type":"string","description":"Signing algorithm to use. Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512, EdDSA.","description_kind":"plain","optional":true},"allowed_client_ids":{"type":["set","string"],"description":"Array of role client ids allowed to use this key for signing. If empty, no roles are allowed. If \"*\", all roles are allowed.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the key.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"rotation_period":{"type":"number","description":"How often to generate a new signing key in number of seconds","description_kind":"plain","optional":true},"verification_ttl":{"type":"number","description":"Controls how long the public portion of a signing key will be available for verification after being rotated in seconds.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_key_allowed_client_id":{"version":0,"block":{"attributes":{"allowed_client_id":{"type":"string","description":"Role Client ID allowed to use the key for signing.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_name":{"type":"string","description":"Name of the key.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_provider":{"version":0,"block":{"attributes":{"allowed_client_ids":{"type":["set","string"],"description":"The client IDs that are permitted to use the provider. If empty, no clients are allowed. If \"*\", all clients are allowed.","description_kind":"plain","optional":true},"https_enabled":{"type":"bool","description":"Set to true if the issuer endpoint uses HTTPS.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"Specifies what will be used as the 'scheme://host:port' component for the 'iss' claim of ID tokens.This value is computed using the issuer_host and https_enabled fields.","description_kind":"plain","computed":true},"issuer_host":{"type":"string","description":"The host for the issuer. Can be either host or host:port.","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of the provider.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"scopes_supported":{"type":["set","string"],"description":"The scopes available for requesting on the provider.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_role":{"version":0,"block":{"attributes":{"client_id":{"type":"string","description":"The value that will be included in the `aud` field of all the OIDC identity tokens issued by this role","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key":{"type":"string","description":"A configured named key, the key must already exist.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"template":{"type":"string","description":"The template string to use for generating tokens. This may be in string-ified JSON or base64 format.","description_kind":"plain","optional":true},"ttl":{"type":"number","description":"TTL of the tokens generated against the role in number of seconds.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_scope":{"version":0,"block":{"attributes":{"description":{"type":"string","description":"The scope's description.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the scope. The openid scope name is reserved.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"template":{"type":"string","description":"The template string for the scope. This may be provided as escaped JSON or base64 encoded JSON.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_jwt_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor of the JWT auth backend","description_kind":"plain","computed":true},"bound_issuer":{"type":"string","description":"The value against which to match the iss claim in a JWT","description_kind":"plain","optional":true},"default_role":{"type":"string","description":"The default role to use if none is provided during login","description_kind":"plain","optional":true},"description":{"type":"string","description":"The description of the auth backend","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"jwks_ca_pem":{"type":"string","description":"The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.","description_kind":"plain","optional":true},"jwks_url":{"type":"string","description":"JWKS URL to use to authenticate signatures. Cannot be used with 'oidc_discovery_url' or 'jwt_validation_pubkeys'.","description_kind":"plain","optional":true},"jwt_supported_algs":{"type":["list","string"],"description":"A list of supported signing algorithms. Defaults to [RS256]","description_kind":"plain","optional":true},"jwt_validation_pubkeys":{"type":["list","string"],"description":"A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with 'jwks_url' or 'oidc_discovery_url'. ","description_kind":"plain","optional":true},"local":{"type":"bool","description":"Specifies if the auth method is local only","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_in_state":{"type":"bool","description":"Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs.","description_kind":"plain","optional":true},"oidc_client_id":{"type":"string","description":"Client ID used for OIDC","description_kind":"plain","optional":true},"oidc_client_secret":{"type":"string","description":"Client Secret used for OIDC","description_kind":"plain","optional":true,"sensitive":true},"oidc_discovery_ca_pem":{"type":"string","description":"The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used","description_kind":"plain","optional":true},"oidc_discovery_url":{"type":"string","description":"The OIDC Discovery URL, without any .well-known component (base path). Cannot be used with 'jwks_url' or 'jwt_validation_pubkeys'.","description_kind":"plain","optional":true},"oidc_response_mode":{"type":"string","description":"The response mode to be used in the OAuth2 request. Allowed values are 'query' and 'form_post'. Defaults to 'query'. If using Vault namespaces, and oidc_response_mode is 'form_post', then 'namespace_in_state' should be set to false.","description_kind":"plain","optional":true},"oidc_response_types":{"type":["list","string"],"description":"The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'. Note: 'id_token' may only be used if 'oidc_response_mode' is set to 'form_post'.","description_kind":"plain","optional":true},"path":{"type":"string","description":"path to mount the backend","description_kind":"plain","optional":true},"provider_config":{"type":["map","string"],"description":"Provider specific handling configuration","description_kind":"plain","optional":true},"tune":{"type":["set",["object",{"allowed_response_headers":["list","string"],"audit_non_hmac_request_keys":["list","string"],"audit_non_hmac_response_keys":["list","string"],"default_lease_ttl":"string","listing_visibility":"string","max_lease_ttl":"string","passthrough_request_headers":["list","string"],"token_type":"string"}]],"description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of backend. Can be either 'jwt' or 'oidc'","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_jwt_auth_backend_role":{"version":0,"block":{"attributes":{"allowed_redirect_uris":{"type":["set","string"],"description":"The list of allowed values for redirect_uri during OIDC logins.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"bound_audiences":{"type":["set","string"],"description":"List of aud claims to match against. Any match is sufficient.","description_kind":"plain","optional":true},"bound_claims":{"type":["map","string"],"description":"Map of claims/values to match against. The expected value may be a single string or a comma-separated string list.","description_kind":"plain","optional":true},"bound_claims_type":{"type":"string","description":"How to interpret values in the claims/values map: can be either \"string\" (exact match) or \"glob\" (wildcard match).","description_kind":"plain","optional":true,"computed":true},"bound_subject":{"type":"string","description":"If set, requires that the sub claim matches this value.","description_kind":"plain","optional":true},"claim_mappings":{"type":["map","string"],"description":"Map of claims (keys) to be copied to specified metadata fields (values).","description_kind":"plain","optional":true},"clock_skew_leeway":{"type":"number","description":"The amount of leeway to add to all claims to account for clock skew, in seconds. Defaults to 60 seconds if set to 0 and can be disabled if set to -1. Only applicable with 'jwt' roles.","description_kind":"plain","optional":true},"disable_bound_claims_parsing":{"type":"bool","description":"Disable bound claim value parsing. Useful when values contain commas.","description_kind":"plain","optional":true},"expiration_leeway":{"type":"number","description":"The amount of leeway to add to expiration (exp) claims to account for clock skew, in seconds. Defaults to 60 seconds if set to 0 and can be disabled if set to -1. Only applicable with 'jwt' roles.","description_kind":"plain","optional":true},"groups_claim":{"type":"string","description":"The claim to use to uniquely identify the set of groups to which the user belongs; this will be used as the names for the Identity group aliases created due to a successful login. The claim value must be a list of strings.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_age":{"type":"number","description":"Specifies the allowable elapsed time in seconds since the last time the user was actively authenticated.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"not_before_leeway":{"type":"number","description":"The amount of leeway to add to not before (nbf) claims to account for clock skew, in seconds. Defaults to 150 seconds if set to 0 and can be disabled if set to -1. Only applicable with 'jwt' roles. ","description_kind":"plain","optional":true},"oidc_scopes":{"type":["set","string"],"description":"List of OIDC scopes to be used with an OIDC role. The standard scope \"openid\" is automatically included and need not be specified.","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"role_type":{"type":"string","description":"Type of role, either \"oidc\" (default) or \"jwt\"","description_kind":"plain","optional":true,"computed":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true},"user_claim":{"type":"string","description":"The claim to use to uniquely identify the user; this will be used as the name for the Identity entity alias created due to a successful login.","description_kind":"plain","required":true},"user_claim_json_pointer":{"type":"bool","description":"Specifies if the user_claim value uses JSON pointer syntax for referencing claims. By default, the user_claim value will not use JSON pointer.","description_kind":"plain","optional":true},"verbose_oidc_logging":{"type":"bool","description":"Log received OIDC tokens and claims when debug-level logging is active. Not recommended in production since sensitive information may be present in OIDC responses.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kmip_secret_backend":{"version":1,"block":{"attributes":{"default_tls_client_key_bits":{"type":"number","description":"Client certificate key bits, valid values depend on key type","description_kind":"plain","optional":true,"computed":true},"default_tls_client_key_type":{"type":"string","description":"Client certificate key type, rsa or ec","description_kind":"plain","optional":true,"computed":true},"default_tls_client_ttl":{"type":"number","description":"Client certificate TTL in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"listen_addrs":{"type":["set","string"],"description":"Addresses the KMIP server should listen on (host:port)","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path where KMIP secret backend will be mounted","description_kind":"plain","required":true},"server_hostnames":{"type":["set","string"],"description":"Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN)","description_kind":"plain","optional":true,"computed":true},"server_ips":{"type":["set","string"],"description":"IPs to include in the server's TLS certificate as SAN IP addresses","description_kind":"plain","optional":true,"computed":true},"tls_ca_key_bits":{"type":"number","description":"CA key bits, valid values depend on key type","description_kind":"plain","optional":true,"computed":true},"tls_ca_key_type":{"type":"string","description":"CA key type, rsa or ec","description_kind":"plain","optional":true,"computed":true},"tls_min_version":{"type":"string","description":"Minimum TLS version to accept","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_kmip_secret_role":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"operation_activate":{"type":"bool","description":"Grant permission to use the KMIP Activate operation","description_kind":"plain","optional":true,"computed":true},"operation_add_attribute":{"type":"bool","description":"Grant permission to use the KMIP Add Attribute operation","description_kind":"plain","optional":true,"computed":true},"operation_all":{"type":"bool","description":"Grant all permissions to this role. May not be specified with any other operation_* params","description_kind":"plain","optional":true,"computed":true},"operation_create":{"type":"bool","description":"Grant permission to use the KMIP Create operation","description_kind":"plain","optional":true,"computed":true},"operation_destroy":{"type":"bool","description":"Grant permission to use the KMIP Destroy operation","description_kind":"plain","optional":true,"computed":true},"operation_discover_versions":{"type":"bool","description":"Grant permission to use the KMIP Discover Version operation","description_kind":"plain","optional":true,"computed":true},"operation_get":{"type":"bool","description":"Grant permission to use the KMIP Get operation","description_kind":"plain","optional":true,"computed":true},"operation_get_attribute_list":{"type":"bool","description":"Grant permission to use the KMIP Get Attribute List operation","description_kind":"plain","optional":true,"computed":true},"operation_get_attributes":{"type":"bool","description":"Grant permission to use the KMIP Get Attributes operation","description_kind":"plain","optional":true,"computed":true},"operation_locate":{"type":"bool","description":"Grant permission to use the KMIP Locate operation","description_kind":"plain","optional":true,"computed":true},"operation_none":{"type":"bool","description":"Remove all permissions from this role. May not be specified with any other operation_* params","description_kind":"plain","optional":true,"computed":true},"operation_register":{"type":"bool","description":"Grant permission to use the KMIP Register operation","description_kind":"plain","optional":true,"computed":true},"operation_rekey":{"type":"bool","description":"Grant permission to use the KMIP Rekey operation","description_kind":"plain","optional":true,"computed":true},"operation_revoke":{"type":"bool","description":"Grant permission to use the KMIP Revoke operation","description_kind":"plain","optional":true,"computed":true},"path":{"type":"string","description":"Path where KMIP backend is mounted","description_kind":"plain","required":true},"role":{"type":"string","description":"Name of the role","description_kind":"plain","required":true},"scope":{"type":"string","description":"Name of the scope","description_kind":"plain","required":true},"tls_client_key_bits":{"type":"number","description":"Client certificate key bits, valid values depend on key type","description_kind":"plain","optional":true},"tls_client_key_type":{"type":"string","description":"Client certificate key type, rsa or ec","description_kind":"plain","optional":true},"tls_client_ttl":{"type":"number","description":"Client certificate TTL in seconds","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kmip_secret_scope":{"version":0,"block":{"attributes":{"force":{"type":"bool","description":"Force deletion even if there are managed objects in the scope","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path where KMIP backend is mounted","description_kind":"plain","required":true},"scope":{"type":"string","description":"Name of the scope","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_kubernetes_auth_backend_config":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the kubernetes backend to configure.","description_kind":"plain","optional":true},"disable_iss_validation":{"type":"bool","description":"Optional disable JWT issuer validation. Allows to skip ISS validation.","description_kind":"plain","optional":true,"computed":true},"disable_local_ca_jwt":{"type":"bool","description":"Optional disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"Optional JWT issuer. If no issuer is specified, kubernetes.io/serviceaccount will be used as the default issuer.","description_kind":"plain","optional":true},"kubernetes_ca_cert":{"type":"string","description":"PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.","description_kind":"plain","optional":true,"computed":true},"kubernetes_host":{"type":"string","description":"Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"pem_keys":{"type":["list","string"],"description":"Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys.","description_kind":"plain","optional":true},"token_reviewer_jwt":{"type":"string","description":"A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API.","description_kind":"plain","optional":true,"sensitive":true}},"description_kind":"plain"}},"vault_kubernetes_auth_backend_role":{"version":0,"block":{"attributes":{"alias_name_source":{"type":"string","description":"Configures how identity aliases are generated. Valid choices are: serviceaccount_uid, serviceaccount_name","description_kind":"plain","optional":true,"computed":true},"audience":{"type":"string","description":"Optional Audience claim to verify in the JWT.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the kubernetes backend to configure.","description_kind":"plain","optional":true},"bound_service_account_names":{"type":["set","string"],"description":"List of service account names able to access this role. If set to `[\"*\"]` all names are allowed, both this and bound_service_account_namespaces can not be \"*\".","description_kind":"plain","required":true},"bound_service_account_namespaces":{"type":["set","string"],"description":"List of namespaces allowed to access this role. If set to `[\"*\"]` all namespaces are allowed, both this and bound_service_account_names can not be set to \"*\".","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kubernetes_secret_backend":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"Accessor of the mount","description_kind":"plain","computed":true},"allowed_managed_keys":{"type":["set","string"],"description":"List of managed key registry entry names that the mount in question is allowed to access","description_kind":"plain","optional":true},"audit_non_hmac_request_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.","description_kind":"plain","optional":true,"computed":true},"audit_non_hmac_response_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.","description_kind":"plain","optional":true,"computed":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount","description_kind":"plain","optional":true},"disable_local_ca_jwt":{"type":"bool","description":"Disable defaulting to the local CA certificate and service account JWT when running in a Kubernetes pod.","description_kind":"plain","optional":true},"external_entropy_access":{"type":"bool","description":"Enable the secrets engine to access Vault's external entropy source","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"kubernetes_ca_cert":{"type":"string","description":"A PEM-encoded CA certificate used by the secret engine to verify the Kubernetes API server certificate. Defaults to the local pod’s CA if found, or otherwise the host's root CA set.","description_kind":"plain","optional":true},"kubernetes_host":{"type":"string","description":"The Kubernetes API URL to connect to.","description_kind":"plain","optional":true},"local":{"type":"bool","description":"Local mount flag that can be explicitly set to true to enforce local mount in HA environment","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"Specifies mount type specific options that are passed to the backend","description_kind":"plain","optional":true},"path":{"type":"string","description":"Where the secret backend will be mounted","description_kind":"plain","required":true},"seal_wrap":{"type":"bool","description":"Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability","description_kind":"plain","optional":true,"computed":true},"service_account_jwt":{"type":"string","description":"The JSON web token of the service account used by the secrets engine to manage Kubernetes credentials. Defaults to the local pod’s JWT if found.","description_kind":"plain","optional":true,"sensitive":true}},"description_kind":"plain"}},"vault_kubernetes_secret_backend_role":{"version":0,"block":{"attributes":{"allowed_kubernetes_namespaces":{"type":["list","string"],"description":"The list of Kubernetes namespaces this role can generate credentials for. If set to '*' all namespaces are allowed.","description_kind":"plain","required":true},"backend":{"type":"string","description":"The mount path for the Kubernetes secrets engine.","description_kind":"plain","required":true},"extra_annotations":{"type":["map","string"],"description":"Additional annotations to apply to all generated Kubernetes objects.","description_kind":"plain","optional":true},"extra_labels":{"type":["map","string"],"description":"Additional labels to apply to all generated Kubernetes objects.","description_kind":"plain","optional":true},"generated_role_rules":{"type":"string","description":"The Role or ClusterRole rules to use when generating a role. Accepts either JSON or YAML formatted rules. Mutually exclusive with 'service_account_name' and 'kubernetes_role_name'. If set, the entire chain of Kubernetes objects will be generated when credentials are requested.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"kubernetes_role_name":{"type":"string","description":"The pre-existing Role or ClusterRole to bind a generated service account to. Mutually exclusive with 'service_account_name' and 'generated_role_rules'. If set, Kubernetes token, service account, and role binding objects will be created when credentials are requested.","description_kind":"plain","optional":true},"kubernetes_role_type":{"type":"string","description":"Specifies whether the Kubernetes role is a Role or ClusterRole.","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of the role.","description_kind":"plain","required":true},"name_template":{"type":"string","description":"The name template to use when generating service accounts, roles and role bindings. If unset, a default template is used.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"service_account_name":{"type":"string","description":"The pre-existing service account to generate tokens for. Mutually exclusive with 'kubernetes_role_name' and 'generated_role_rules'. If set, only a Kubernetes token will be created when credentials are requested.","description_kind":"plain","optional":true},"token_default_ttl":{"type":"number","description":"The default TTL for generated Kubernetes tokens in seconds.","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum TTL for generated Kubernetes tokens in seconds.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kv_secret":{"version":0,"block":{"attributes":{"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data to write.","description_kind":"plain","required":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path of the KV-V1 secret.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_kv_secret_backend_v2":{"version":0,"block":{"attributes":{"cas_required":{"type":"bool","description":"If true, all keys will require the cas parameter to be set on all write requests.","description_kind":"plain","optional":true,"computed":true},"delete_version_after":{"type":"number","description":"If set, specifies the length of time before a version is deleted","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_versions":{"type":"number","description":"The number of versions to keep per key.","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Path where KV-V2 engine is mounted.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kv_secret_v2":{"version":0,"block":{"attributes":{"cas":{"type":"number","description":"This flag is required if cas_required is set to true on either the secret or the engine's config. In order for a write to be successful, cas must be set to the current version of the secret.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data to write.","description_kind":"plain","required":true,"sensitive":true},"delete_all_versions":{"type":"bool","description":"If set to true, permanently deletes all versions for the specified key.","description_kind":"plain","optional":true},"disable_read":{"type":"bool","description":"If set to true, disables reading secret from Vault; note: drift won't be detected.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"metadata":{"type":["map","string"],"description":"Metadata associated with this secret read from Vault.","description_kind":"plain","computed":true},"mount":{"type":"string","description":"Path where KV-V2 engine is mounted.","description_kind":"plain","required":true},"name":{"type":"string","description":"Full name of the secret. For a nested secret, the name is the nested path excluding the mount and data prefix. For example, for a secret at 'kvv2/data/foo/bar/baz', the name is 'foo/bar/baz'","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"An object that holds option settings.","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where the KV-V2 secret will be written.","description_kind":"plain","computed":true}},"block_types":{"custom_metadata":{"nesting_mode":"list","block":{"attributes":{"cas_required":{"type":"bool","description":"If true, all keys will require the cas parameter to be set on all write requests.","description_kind":"plain","optional":true},"data":{"type":["map","string"],"description":"A map of arbitrary string to string valued user-provided metadata meant to describe the secret.","description_kind":"plain","optional":true},"delete_version_after":{"type":"number","description":"If set, specifies the length of time before a version is deleted.","description_kind":"plain","optional":true},"max_versions":{"type":"number","description":"The number of versions to keep per key.","description_kind":"plain","optional":true}},"description":"Custom metadata to be set for the secret.","description_kind":"plain"},"max_items":1}},"description_kind":"plain"}},"vault_ldap_auth_backend":{"version":2,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor of the LDAP auth backend","description_kind":"plain","computed":true},"binddn":{"type":"string","description_kind":"plain","optional":true,"computed":true},"bindpass":{"type":"string","description_kind":"plain","optional":true,"computed":true,"sensitive":true},"case_sensitive_names":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"certificate":{"type":"string","description_kind":"plain","optional":true,"computed":true},"client_tls_cert":{"type":"string","description_kind":"plain","optional":true,"computed":true},"client_tls_key":{"type":"string","description_kind":"plain","optional":true,"computed":true,"sensitive":true},"deny_null_bind":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description_kind":"plain","optional":true,"computed":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"discoverdn":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"groupattr":{"type":"string","description_kind":"plain","optional":true,"computed":true},"groupdn":{"type":"string","description_kind":"plain","optional":true,"computed":true},"groupfilter":{"type":"string","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"insecure_tls":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Specifies if the auth method is local only","description_kind":"plain","optional":true},"max_page_size":{"type":"number","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description_kind":"plain","optional":true},"starttls":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"tls_max_version":{"type":"string","description_kind":"plain","optional":true,"computed":true},"tls_min_version":{"type":"string","description_kind":"plain","optional":true,"computed":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true},"upndomain":{"type":"string","description_kind":"plain","optional":true,"computed":true},"url":{"type":"string","description_kind":"plain","required":true},"use_token_groups":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"userattr":{"type":"string","description_kind":"plain","optional":true,"computed":true},"userdn":{"type":"string","description_kind":"plain","optional":true,"computed":true},"userfilter":{"type":"string","description_kind":"plain","optional":true,"computed":true},"username_as_alias":{"type":"bool","description":"Force the auth method to use the username passed by the user as the alias name.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_ldap_auth_backend_group":{"version":1,"block":{"attributes":{"backend":{"type":"string","description_kind":"plain","optional":true},"groupname":{"type":"string","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_ldap_auth_backend_user":{"version":1,"block":{"attributes":{"backend":{"type":"string","description_kind":"plain","optional":true},"groups":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description_kind":"plain","optional":true,"computed":true},"username":{"type":"string","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_ldap_secret_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"Accessor of the mount","description_kind":"plain","computed":true},"allowed_managed_keys":{"type":["set","string"],"description":"List of managed key registry entry names that the mount in question is allowed to access","description_kind":"plain","optional":true},"audit_non_hmac_request_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.","description_kind":"plain","optional":true,"computed":true},"audit_non_hmac_response_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.","description_kind":"plain","optional":true,"computed":true},"binddn":{"type":"string","description":"Distinguished name of object to bind when performing user and group search.","description_kind":"plain","required":true},"bindpass":{"type":"string","description":"LDAP password for searching for the user DN.","description_kind":"plain","required":true,"sensitive":true},"certificate":{"type":"string","description":"CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.","description_kind":"plain","optional":true},"client_tls_cert":{"type":"string","description":"Client certificate to provide to the LDAP server, must be x509 PEM encoded.","description_kind":"plain","optional":true,"sensitive":true},"client_tls_key":{"type":"string","description":"Client certificate key to provide to the LDAP server, must be x509 PEM encoded.","description_kind":"plain","optional":true,"sensitive":true},"connection_timeout":{"type":"number","description":"Timeout, in seconds, when attempting to connect to the LDAP server before trying the next URL in the configuration.","description_kind":"plain","optional":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"external_entropy_access":{"type":"bool","description":"Enable the secrets engine to access Vault's external entropy source","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"insecure_tls":{"type":"bool","description":"Skip LDAP server SSL Certificate verification - insecure and not recommended for production use.","description_kind":"plain","optional":true},"length":{"type":"number","description":"The desired length of passwords that Vault generates.","description_kind":"plain","deprecated":true,"optional":true,"computed":true},"local":{"type":"bool","description":"Local mount flag that can be explicitly set to true to enforce local mount in HA environment","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"Specifies mount type specific options that are passed to the backend","description_kind":"plain","optional":true},"password_policy":{"type":"string","description":"Name of the password policy to use to generate passwords.","description_kind":"plain","optional":true},"path":{"type":"string","description":"The path where the LDAP secrets backend is mounted.","description_kind":"plain","optional":true},"request_timeout":{"type":"number","description":"Timeout, in seconds, for the connection when making requests against the server before returning back an error.","description_kind":"plain","optional":true,"computed":true},"schema":{"type":"string","description":"The LDAP schema to use when storing entry passwords. Valid schemas include openldap, ad, and racf.","description_kind":"plain","optional":true,"computed":true},"seal_wrap":{"type":"bool","description":"Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability","description_kind":"plain","optional":true,"computed":true},"starttls":{"type":"bool","description":"Issue a StartTLS command after establishing unencrypted connection.","description_kind":"plain","optional":true,"computed":true},"upndomain":{"type":"string","description":"Enables userPrincipalDomain login with [username]@UPNDomain.","description_kind":"plain","optional":true,"computed":true},"url":{"type":"string","description":"LDAP URL to connect to (default: ldap://127.0.0.1). Multiple URLs can be specified by concatenating them with commas; they will be tried in-order.","description_kind":"plain","optional":true,"computed":true},"userattr":{"type":"string","description":"Attribute used for users (default: cn)","description_kind":"plain","optional":true,"computed":true},"userdn":{"type":"string","description":"LDAP domain to use for users (eg: ou=People,dc=example,dc=org)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_ldap_secret_backend_dynamic_role":{"version":0,"block":{"attributes":{"creation_ldif":{"type":"string","description":"A templatized LDIF string used to create a user account. May contain multiple entries.","description_kind":"plain","required":true},"default_ttl":{"type":"number","description":"Specifies the TTL for the leases associated with this role.","description_kind":"plain","optional":true},"deletion_ldif":{"type":"string","description":"A templatized LDIF string used to delete the user account once its TTL has expired. This may contain multiple LDIF entries.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"Specifies the maximum TTL for the leases associated with this role.","description_kind":"plain","optional":true},"mount":{"type":"string","description":"The path where the LDAP secrets backend is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"rollback_ldif":{"type":"string","description":"A templatized LDIF string used to attempt to rollback any changes in the event that execution of the creation_ldif results in an error. This may contain multiple LDIF entries.","description_kind":"plain","optional":true},"username_template":{"type":"string","description":"A template used to generate a dynamic username. This will be used to fill in the .Username field within the creation_ldif string.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_ldap_secret_backend_library_set":{"version":0,"block":{"attributes":{"disable_check_in_enforcement":{"type":"bool","description":"Disable enforcing that service accounts must be checked in by the entity or client token that checked them out.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"The maximum amount of time a check-out last with renewal before Vault automatically checks it back in. Defaults to 24 hours.","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"The path where the LDAP secrets backend is mounted.","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of the set of service accounts.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"service_account_names":{"type":["list","string"],"description":"The names of all the service accounts that can be checked out from this set.","description_kind":"plain","required":true},"ttl":{"type":"number","description":"The maximum amount of time a single check-out lasts before Vault automatically checks it back in. Defaults to 24 hours.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_ldap_secret_backend_static_role":{"version":0,"block":{"attributes":{"dn":{"type":"string","description":"Distinguished name (DN) of the existing LDAP entry to manage password rotation for.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"The path where the LDAP secrets backend is mounted.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"rotation_period":{"type":"number","description":"How often Vault should rotate the password of the user entry.","description_kind":"plain","required":true},"username":{"type":"string","description":"The username of the existing LDAP entry to manage password rotation for.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_managed_keys":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"block_types":{"aws":{"nesting_mode":"set","block":{"attributes":{"access_key":{"type":"string","description":"The AWS access key to use","description_kind":"plain","required":true},"allow_generate_key":{"type":"bool","description":"If no existing key can be found in the referenced backend, instructs Vault to generate a key within the backend","description_kind":"plain","optional":true,"computed":true},"allow_replace_key":{"type":"bool","description":"Controls the ability for Vault to replace through generation or importing a key into the configured backend even if a key is present, if set to false those operations are forbidden if a key exists.","description_kind":"plain","optional":true,"computed":true},"allow_store_key":{"type":"bool","description":"Controls the ability for Vault to import a key to the configured backend, if 'false', those operations will be forbidden","description_kind":"plain","optional":true,"computed":true},"any_mount":{"type":"bool","description":"Allow usage from any mount point within the namespace if 'true'","description_kind":"plain","optional":true,"computed":true},"curve":{"type":"string","description":"The curve to use for an ECDSA key. Used when key_type is 'ECDSA'. Required if 'allow_generate_key' is true","description_kind":"plain","optional":true},"endpoint":{"type":"string","description":"Used to specify a custom AWS endpoint","description_kind":"plain","optional":true},"key_bits":{"type":"string","description":"The size in bits for an RSA key. This field is required when 'key_type' is 'RSA'","description_kind":"plain","required":true},"key_type":{"type":"string","description":"The type of key to use","description_kind":"plain","required":true},"kms_key":{"type":"string","description":"An identifier for the key","description_kind":"plain","required":true},"name":{"type":"string","description":"A unique lowercase name that serves as identifying the key","description_kind":"plain","required":true},"region":{"type":"string","description":"The AWS region where the keys are stored (or will be stored)","description_kind":"plain","optional":true,"computed":true},"secret_key":{"type":"string","description":"The AWS secret key to use","description_kind":"plain","required":true},"uuid":{"type":"string","description":"ID of the managed key read from Vault","description_kind":"plain","computed":true}},"description":"Configuration block for AWS Managed Keys","description_kind":"plain"}},"azure":{"nesting_mode":"set","block":{"attributes":{"allow_generate_key":{"type":"bool","description":"If no existing key can be found in the referenced backend, instructs Vault to generate a key within the backend","description_kind":"plain","optional":true,"computed":true},"allow_replace_key":{"type":"bool","description":"Controls the ability for Vault to replace through generation or importing a key into the configured backend even if a key is present, if set to false those operations are forbidden if a key exists.","description_kind":"plain","optional":true,"computed":true},"allow_store_key":{"type":"bool","description":"Controls the ability for Vault to import a key to the configured backend, if 'false', those operations will be forbidden","description_kind":"plain","optional":true,"computed":true},"any_mount":{"type":"bool","description":"Allow usage from any mount point within the namespace if 'true'","description_kind":"plain","optional":true,"computed":true},"client_id":{"type":"string","description":"The client id for credentials to query the Azure APIs","description_kind":"plain","required":true},"client_secret":{"type":"string","description":"The client secret for credentials to query the Azure APIs","description_kind":"plain","required":true},"environment":{"type":"string","description":"The Azure Cloud environment API endpoints to use","description_kind":"plain","optional":true,"computed":true},"key_bits":{"type":"string","description":"The size in bits for an RSA key. This field is required when 'key_type' is 'RSA' or when 'allow_generate_key' is true","description_kind":"plain","optional":true},"key_name":{"type":"string","description":"The Key Vault key to use for encryption and decryption","description_kind":"plain","required":true},"key_type":{"type":"string","description":"The type of key to use","description_kind":"plain","required":true},"name":{"type":"string","description":"A unique lowercase name that serves as identifying the key","description_kind":"plain","required":true},"resource":{"type":"string","description":"The Azure Key Vault resource's DNS Suffix to connect to","description_kind":"plain","optional":true,"computed":true},"tenant_id":{"type":"string","description":"The tenant id for the Azure Active Directory organization","description_kind":"plain","required":true},"uuid":{"type":"string","description":"ID of the managed key read from Vault","description_kind":"plain","computed":true},"vault_name":{"type":"string","description":"The Key Vault vault to use the encryption keys for encryption and decryption","description_kind":"plain","required":true}},"description":"Configuration block for Azure Managed Keys","description_kind":"plain"}},"pkcs":{"nesting_mode":"set","block":{"attributes":{"allow_generate_key":{"type":"bool","description":"If no existing key can be found in the referenced backend, instructs Vault to generate a key within the backend","description_kind":"plain","optional":true,"computed":true},"allow_replace_key":{"type":"bool","description":"Controls the ability for Vault to replace through generation or importing a key into the configured backend even if a key is present, if set to false those operations are forbidden if a key exists.","description_kind":"plain","optional":true,"computed":true},"allow_store_key":{"type":"bool","description":"Controls the ability for Vault to import a key to the configured backend, if 'false', those operations will be forbidden","description_kind":"plain","optional":true,"computed":true},"any_mount":{"type":"bool","description":"Allow usage from any mount point within the namespace if 'true'","description_kind":"plain","optional":true,"computed":true},"curve":{"type":"string","description":"Supplies the curve value when using the 'CKM_ECDSA' mechanism. Required if 'allow_generate_key' is true","description_kind":"plain","optional":true},"force_rw_session":{"type":"string","description":"Force all operations to open up a read-write session to the HSM","description_kind":"plain","optional":true},"key_bits":{"type":"string","description":"Supplies the size in bits of the key when using 'CKM_RSA_PKCS_PSS', 'CKM_RSA_PKCS_OAEP' or 'CKM_RSA_PKCS' as a value for 'mechanism'. Required if 'allow_generate_key' is true","description_kind":"plain","optional":true},"key_id":{"type":"string","description":"The id of a PKCS#11 key to use","description_kind":"plain","required":true},"key_label":{"type":"string","description":"The label of the key to use","description_kind":"plain","required":true},"library":{"type":"string","description":"The name of the kms_library stanza to use from Vault's config to lookup the local library path","description_kind":"plain","required":true},"mechanism":{"type":"string","description":"The encryption/decryption mechanism to use, specified as a hexadecimal (prefixed by 0x) string.","description_kind":"plain","required":true},"name":{"type":"string","description":"A unique lowercase name that serves as identifying the key","description_kind":"plain","required":true},"pin":{"type":"string","description":"The PIN for login","description_kind":"plain","required":true},"slot":{"type":"string","description":"The slot number to use, specified as a string in a decimal format (e.g. '2305843009213693953')","description_kind":"plain","optional":true},"token_label":{"type":"string","description":"The slot token label to use","description_kind":"plain","optional":true},"uuid":{"type":"string","description":"ID of the managed key read from Vault","description_kind":"plain","computed":true}},"description":"Configuration block for PKCS Managed Keys","description_kind":"plain"}}},"description_kind":"plain"}},"vault_mfa_duo":{"version":0,"block":{"attributes":{"api_hostname":{"type":"string","description":"API hostname for Duo.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"integration_key":{"type":"string","description":"Integration key for Duo.","description_kind":"plain","required":true,"sensitive":true},"mount_accessor":{"type":"string","description":"The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the MFA method.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"push_info":{"type":"string","description":"Push information for Duo.","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"Secret key for Duo.","description_kind":"plain","required":true,"sensitive":true},"username_format":{"type":"string","description":"A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_mfa_okta":{"version":0,"block":{"attributes":{"api_token":{"type":"string","description":"Okta API key.","description_kind":"plain","required":true,"sensitive":true},"base_url":{"type":"string","description":"If set, will be used as the base domain for API requests.","description_kind":"plain","optional":true},"id":{"type":"string","description":"ID computed by Vault.","description_kind":"plain","optional":true,"computed":true},"mount_accessor":{"type":"string","description":"The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the MFA method.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"org_name":{"type":"string","description":"Name of the organization to be used in the Okta API.","description_kind":"plain","required":true},"primary_email":{"type":"bool","description":"If set to true, the username will only match the primary email for the account.","description_kind":"plain","optional":true},"username_format":{"type":"string","description":"A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_mfa_pingid":{"version":0,"block":{"attributes":{"admin_url":{"type":"string","description":"Admin URL computed by Vault.","description_kind":"plain","computed":true},"authenticator_url":{"type":"string","description":"Authenticator URL computed by Vault.","description_kind":"plain","computed":true},"id":{"type":"string","description":"ID computed by Vault.","description_kind":"plain","optional":true,"computed":true},"idp_url":{"type":"string","description":"IDP URL computed by Vault.","description_kind":"plain","computed":true},"mount_accessor":{"type":"string","description":"The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the MFA method.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Namespace ID computed by Vault.","description_kind":"plain","computed":true},"org_alias":{"type":"string","description":"Org Alias computed by Vault.","description_kind":"plain","computed":true},"settings_file_base64":{"type":"string","description":"A base64-encoded third-party settings file retrieved from PingID's configuration page.","description_kind":"plain","required":true},"type":{"type":"string","description":"Type of configuration computed by Vault.","description_kind":"plain","computed":true},"use_signature":{"type":"bool","description":"If set, enables use of PingID signature. Computed by Vault","description_kind":"plain","computed":true},"username_format":{"type":"string","description":"A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_mfa_totp":{"version":0,"block":{"attributes":{"algorithm":{"type":"string","description":"Specifies the hashing algorithm used to generate the TOTP code. Options include 'SHA1', 'SHA256' and 'SHA512'.","description_kind":"plain","optional":true},"digits":{"type":"number","description":"The number of digits in the generated TOTP token. This value can either be 6 or 8.","description_kind":"plain","optional":true},"id":{"type":"string","description":"ID computed by Vault.","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"The name of the key's issuing organization.","description_kind":"plain","required":true},"key_size":{"type":"number","description":"Specifies the size in bytes of the generated key.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the MFA method.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"period":{"type":"number","description":"The length of time used to generate a counter for the TOTP token calculation.","description_kind":"plain","optional":true},"qr_size":{"type":"number","description":"The pixel size of the generated square QR code.","description_kind":"plain","optional":true},"skew":{"type":"number","description":"The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_mongodbatlas_secret_backend":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Path where MongoDB Atlas secret backend is mounted","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path where MongoDB Atlas configuration is located","description_kind":"plain","computed":true},"private_key":{"type":"string","description":"The Private Programmatic API Key used to connect with MongoDB Atlas API","description_kind":"plain","required":true},"public_key":{"type":"string","description":"The Public Programmatic API Key used to authenticate with the MongoDB Atlas API","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_mongodbatlas_secret_role":{"version":0,"block":{"attributes":{"cidr_blocks":{"type":["list","string"],"description":"Whitelist entry in CIDR notation to be added for the API key","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_addresses":{"type":["list","string"],"description":"IP address to be added to the whitelist for the API key","description_kind":"plain","optional":true},"max_ttl":{"type":"string","description":"The maximum allowed lifetime of credentials issued using this role","description_kind":"plain","optional":true},"mount":{"type":"string","description":"Path where MongoDB Atlas secret backend is mounted","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the role","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization_id":{"type":"string","description":"ID for the organization to which the target API Key belongs","description_kind":"plain","optional":true},"project_id":{"type":"string","description":"ID for the project to which the target API Key belongs","description_kind":"plain","optional":true},"project_roles":{"type":["list","string"],"description":"Roles assigned when an org API key is assigned to a project API key","description_kind":"plain","optional":true},"roles":{"type":["list","string"],"description":"List of roles that the API Key needs to have","description_kind":"plain","required":true},"ttl":{"type":"string","description":"Duration in seconds after which the issued credential should expire","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_mount":{"version":0,"block":{"attributes":{"accessor":{"type":"string","description":"Accessor of the mount","description_kind":"plain","computed":true},"allowed_managed_keys":{"type":["set","string"],"description":"List of managed key registry entry names that the mount in question is allowed to access","description_kind":"plain","optional":true},"audit_non_hmac_request_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.","description_kind":"plain","optional":true,"computed":true},"audit_non_hmac_response_keys":{"type":["list","string"],"description":"Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.","description_kind":"plain","optional":true,"computed":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount","description_kind":"plain","optional":true},"external_entropy_access":{"type":"bool","description":"Enable the secrets engine to access Vault's external entropy source","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Local mount flag that can be explicitly set to true to enforce local mount in HA environment","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for tokens and secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"options":{"type":["map","string"],"description":"Specifies mount type specific options that are passed to the backend","description_kind":"plain","optional":true},"path":{"type":"string","description":"Where the secret backend will be mounted","description_kind":"plain","required":true},"seal_wrap":{"type":"bool","description":"Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability","description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of the backend, such as 'aws'","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_namespace":{"version":0,"block":{"attributes":{"custom_metadata":{"type":["map","string"],"description":"Custom metadata describing this namespace. Value type is map[string]string.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description":"Namespace ID.","description_kind":"plain","computed":true},"path":{"type":"string","description":"Namespace path.","description_kind":"plain","required":true},"path_fq":{"type":"string","description":"The fully qualified namespace path.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_nomad_secret_backend":{"version":1,"block":{"attributes":{"address":{"type":"string","description":"Specifies the address of the Nomad instance, provided as \"protocol://host:port\" like \"http://127.0.0.1:4646\".","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The mount path for the Nomad backend.","description_kind":"plain","optional":true},"ca_cert":{"type":"string","description":"CA certificate to use when verifying Nomad server certificate, must be x509 PEM encoded.","description_kind":"plain","optional":true},"client_cert":{"type":"string","description":"Client certificate used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_key.","description_kind":"plain","optional":true,"sensitive":true},"client_key":{"type":"string","description":"Client key used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert.","description_kind":"plain","optional":true,"sensitive":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds.","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"local":{"type":"bool","description":"Mark the secrets engine as local-only. Local engines are not replicated or removed by replication. Tolerance duration to use when checking the last rotation time.","description_kind":"plain","optional":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds.","description_kind":"plain","optional":true,"computed":true},"max_token_name_length":{"type":"number","description":"Specifies the maximum length to use for the name of the Nomad token generated with Generate Credential. If omitted, 0 is used and ignored, defaulting to the max value allowed by the Nomad version.","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"Maximum possible lease duration for secrets in seconds.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"token":{"type":"string","description":"Specifies the Nomad Management token to use.","description_kind":"plain","optional":true,"sensitive":true},"ttl":{"type":"number","description":"Maximum possible lease duration for secrets in seconds.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_nomad_secret_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The mount path for the Nomad backend.","description_kind":"plain","required":true},"global":{"type":"bool","description":"Specifies if the token should be global.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policies":{"type":["list","string"],"description":"Comma separated list of Nomad policies the token is going to be created against. These need to be created beforehand in Nomad.","description_kind":"plain","optional":true,"computed":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"type":{"type":"string","description":"Specifies the type of token to create when using this role. Valid values are \"client\" or \"management\".","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_okta_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The mount accessor related to the auth mount.","description_kind":"plain","computed":true},"base_url":{"type":"string","description":"The Okta url. Examples: oktapreview.com, okta.com (default)","description_kind":"plain","optional":true},"bypass_okta_mfa":{"type":"bool","description":"When true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.","description_kind":"plain","optional":true},"description":{"type":"string","description":"The description of the auth backend","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"group":{"type":["set",["object",{"group_name":"string","policies":["set","string"]}]],"description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"string","description":"Maximum duration after which authentication will be expired","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"The Okta organization. This will be the first part of the url https://XXX.okta.com.","description_kind":"plain","required":true},"path":{"type":"string","description":"path to mount the backend","description_kind":"plain","optional":true},"token":{"type":"string","description":"The Okta API token. This is required to query Okta for user group membership. If this is not supplied only locally configured groups will be enabled.","description_kind":"plain","optional":true,"sensitive":true},"ttl":{"type":"string","description":"Duration after which authentication will be expired","description_kind":"plain","optional":true},"user":{"type":["set",["object",{"groups":["set","string"],"policies":["set","string"],"username":"string"}]],"description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_okta_auth_backend_group":{"version":0,"block":{"attributes":{"group_name":{"type":"string","description":"Name of the Okta group","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to the Okta auth backend","description_kind":"plain","required":true},"policies":{"type":["set","string"],"description":"Policies to associate with this group","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_okta_auth_backend_user":{"version":0,"block":{"attributes":{"groups":{"type":["set","string"],"description":"Groups within the Okta auth backend to associate with this user","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to the Okta auth backend","description_kind":"plain","required":true},"policies":{"type":["set","string"],"description":"Policies to associate with this user","description_kind":"plain","optional":true},"username":{"type":"string","description":"Name of the user within Okta","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_password_policy":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the password policy.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policy":{"type":"string","description":"The password policy document","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_pki_secret_backend_cert":{"version":0,"block":{"attributes":{"alt_names":{"type":["list","string"],"description":"List of alternative names.","description_kind":"plain","optional":true},"auto_renew":{"type":"bool","description":"If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"ca_chain":{"type":"string","description":"The CA chain.","description_kind":"plain","computed":true},"certificate":{"type":"string","description":"The certicate.","description_kind":"plain","computed":true},"common_name":{"type":"string","description":"CN of the certificate to create.","description_kind":"plain","required":true},"exclude_cn_from_sans":{"type":"bool","description":"Flag to exclude CN from SANs.","description_kind":"plain","optional":true},"expiration":{"type":"number","description":"The certificate expiration as a Unix-style timestamp.","description_kind":"plain","computed":true},"format":{"type":"string","description":"The format of data.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_sans":{"type":["list","string"],"description":"List of alternative IPs.","description_kind":"plain","optional":true},"issuer_ref":{"type":"string","description":"Specifies the default issuer of this request.","description_kind":"plain","optional":true},"issuing_ca":{"type":"string","description":"The issuing CA.","description_kind":"plain","computed":true},"min_seconds_remaining":{"type":"number","description":"Generate a new certificate when the expiration is within this number of seconds","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the role to create the certificate against.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"other_sans":{"type":["list","string"],"description":"List of other SANs.","description_kind":"plain","optional":true},"private_key":{"type":"string","description":"The private key.","description_kind":"plain","computed":true,"sensitive":true},"private_key_format":{"type":"string","description":"The private key format.","description_kind":"plain","optional":true},"private_key_type":{"type":"string","description":"The private key type.","description_kind":"plain","computed":true},"renew_pending":{"type":"bool","description":"Initially false, and then set to true during refresh once the expiration is less than min_seconds_remaining in the future.","description_kind":"plain","computed":true},"revoke":{"type":"bool","description":"Revoke the certificate upon resource destruction.","description_kind":"plain","optional":true},"serial_number":{"type":"string","description":"The serial number.","description_kind":"plain","computed":true},"ttl":{"type":"string","description":"Time to live.","description_kind":"plain","optional":true},"uri_sans":{"type":["list","string"],"description":"List of alternative URIs.","description_kind":"plain","optional":true},"user_ids":{"type":["list","string"],"description":"List of Subject User IDs.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_config_ca":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"pem_bundle":{"type":"string","description":"The key and certificate PEM bundle.","description_kind":"plain","required":true,"sensitive":true}},"description_kind":"plain"}},"vault_pki_secret_backend_config_issuers":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"default":{"type":"string","description":"Specifies the default issuer by ID.","description_kind":"plain","optional":true},"default_follows_latest_issuer":{"type":"bool","description":"Specifies whether a root creation or an issuer import operation updates the default issuer to the newly added issuer.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_config_urls":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"crl_distribution_points":{"type":["list","string"],"description":"Specifies the URL values for the CRL Distribution Points field.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuing_certificates":{"type":["list","string"],"description":"Specifies the URL values for the Issuing Certificate field.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"ocsp_servers":{"type":["list","string"],"description":"Specifies the URL values for the OCSP Servers field.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_crl_config":{"version":0,"block":{"attributes":{"auto_rebuild":{"type":"bool","description":"Enables or disables periodic rebuilding of the CRL upon expiry.","description_kind":"plain","optional":true},"auto_rebuild_grace_period":{"type":"string","description":"Grace period before CRL expiry to attempt rebuild of CRL.","description_kind":"plain","optional":true,"computed":true},"backend":{"type":"string","description":"The path of the PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"cross_cluster_revocation":{"type":"bool","description":"Enable cross-cluster revocation request queues.","description_kind":"plain","optional":true,"computed":true},"delta_rebuild_interval":{"type":"string","description":"Interval to check for new revocations on, to regenerate the delta CRL.","description_kind":"plain","optional":true,"computed":true},"disable":{"type":"bool","description":"Disables or enables CRL building","description_kind":"plain","optional":true},"enable_delta":{"type":"bool","description":"Enables or disables building of delta CRLs with up-to-date revocation information, augmenting the last complete CRL.","description_kind":"plain","optional":true},"expiry":{"type":"string","description":"Specifies the time until expiration.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"ocsp_disable":{"type":"bool","description":"Disables or enables the OCSP responder in Vault.","description_kind":"plain","optional":true},"ocsp_expiry":{"type":"string","description":"The amount of time an OCSP response can be cached for, useful for OCSP stapling refresh durations.","description_kind":"plain","optional":true,"computed":true},"unified_crl":{"type":"bool","description":"Enables unified CRL and OCSP building.","description_kind":"plain","optional":true,"computed":true},"unified_crl_on_existing_paths":{"type":"bool","description":"Enables serving the unified CRL and OCSP on the existing, previously cluster-local paths.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_pki_secret_backend_intermediate_cert_request":{"version":0,"block":{"attributes":{"add_basic_constraints":{"type":"bool","description":"Set 'CA: true' in a Basic Constraints extension. Only needed as\na workaround in some compatibility scenarios with Active Directory Certificate Services.","description_kind":"plain","optional":true},"alt_names":{"type":["list","string"],"description":"List of alternative names.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"common_name":{"type":"string","description":"CN of intermediate to create.","description_kind":"plain","required":true},"country":{"type":"string","description":"The country.","description_kind":"plain","optional":true},"csr":{"type":"string","description":"The CSR.","description_kind":"plain","computed":true},"exclude_cn_from_sans":{"type":"bool","description":"Flag to exclude CN from SANs.","description_kind":"plain","optional":true},"format":{"type":"string","description":"The format of data.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_sans":{"type":["list","string"],"description":"List of alternative IPs.","description_kind":"plain","optional":true},"key_bits":{"type":"number","description":"The number of bits to use.","description_kind":"plain","optional":true},"key_id":{"type":"string","description":"The ID of the generated key.","description_kind":"plain","computed":true},"key_name":{"type":"string","description":"When a new key is created with this request, optionally specifies the name for this.","description_kind":"plain","optional":true,"computed":true},"key_ref":{"type":"string","description":"Specifies the key to use for generating this request.","description_kind":"plain","optional":true,"computed":true},"key_type":{"type":"string","description":"The desired key type.","description_kind":"plain","optional":true},"locality":{"type":"string","description":"The locality.","description_kind":"plain","optional":true},"managed_key_id":{"type":"string","description":"The ID of the previously configured managed key.","description_kind":"plain","optional":true},"managed_key_name":{"type":"string","description":"The name of the previously configured managed key.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"The organization.","description_kind":"plain","optional":true},"other_sans":{"type":["list","string"],"description":"List of other SANs.","description_kind":"plain","optional":true},"ou":{"type":"string","description":"The organization unit.","description_kind":"plain","optional":true},"postal_code":{"type":"string","description":"The postal code.","description_kind":"plain","optional":true},"private_key":{"type":"string","description":"The private key.","description_kind":"plain","computed":true,"sensitive":true},"private_key_format":{"type":"string","description":"The private key format.","description_kind":"plain","optional":true},"private_key_type":{"type":"string","description":"The private key type.","description_kind":"plain","computed":true},"province":{"type":"string","description":"The province.","description_kind":"plain","optional":true},"street_address":{"type":"string","description":"The street address.","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of intermediate to create. Must be either \"existing\", \"exported\", \"internal\" or \"kms\"","description_kind":"plain","required":true},"uri_sans":{"type":["list","string"],"description":"List of alternative URIs.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_intermediate_set_signed":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"certificate":{"type":"string","description":"The certificate.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"imported_issuers":{"type":["list","string"],"description":"The imported issuers.","description_kind":"plain","computed":true},"imported_keys":{"type":["list","string"],"description":"The imported keys.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_issuer":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"crl_distribution_points":{"type":["list","string"],"description":"Specifies the URL values for the CRL Distribution Points field.","description_kind":"plain","optional":true},"enable_aia_url_templating":{"type":"bool","description":"Specifies that the AIA URL values should be templated.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer_id":{"type":"string","description":"ID of the issuer.","description_kind":"plain","computed":true},"issuer_name":{"type":"string","description":"Reference to an existing issuer.","description_kind":"plain","optional":true},"issuer_ref":{"type":"string","description":"Reference to an existing issuer.","description_kind":"plain","required":true},"issuing_certificates":{"type":["list","string"],"description":"Specifies the URL values for the Issuing Certificate field.","description_kind":"plain","optional":true},"leaf_not_after_behavior":{"type":"string","description":"Behavior of a leaf's 'NotAfter' field during issuance.","description_kind":"plain","optional":true,"computed":true},"manual_chain":{"type":["list","string"],"description":"Chain of issuer references to build this issuer's computed CAChain field from, when non-empty.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"ocsp_servers":{"type":["list","string"],"description":"Specifies the URL values for the OCSP Servers field.","description_kind":"plain","optional":true},"revocation_signature_algorithm":{"type":"string","description":"Which signature algorithm to use when building CRLs.","description_kind":"plain","optional":true,"computed":true},"usage":{"type":"string","description":"Comma-separated list of allowed usages for this issuer.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_pki_secret_backend_key":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_bits":{"type":"number","description":"Specifies the number of bits to use for the generated keys.","description_kind":"plain","optional":true,"computed":true},"key_id":{"type":"string","description":"ID of the generated key.","description_kind":"plain","computed":true},"key_name":{"type":"string","description":"When a new key is created with this request, optionally specifies the name for this.","description_kind":"plain","optional":true},"key_type":{"type":"string","description":"Specifies the desired key type; must be 'rsa', 'ed25519' or 'ec'.","description_kind":"plain","optional":true,"computed":true},"managed_key_id":{"type":"string","description":"The managed key's UUID.","description_kind":"plain","optional":true},"managed_key_name":{"type":"string","description":"The managed key's configured name.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"type":{"type":"string","description":"Specifies the type of the key to create.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_pki_secret_backend_role":{"version":0,"block":{"attributes":{"allow_any_name":{"type":"bool","description":"Flag to allow any name","description_kind":"plain","optional":true},"allow_bare_domains":{"type":"bool","description":"Flag to allow certificates matching the actual domain.","description_kind":"plain","optional":true},"allow_glob_domains":{"type":"bool","description":"Flag to allow names containing glob patterns.","description_kind":"plain","optional":true},"allow_ip_sans":{"type":"bool","description":"Flag to allow IP SANs","description_kind":"plain","optional":true},"allow_localhost":{"type":"bool","description":"Flag to allow certificates for localhost.","description_kind":"plain","optional":true},"allow_subdomains":{"type":"bool","description":"Flag to allow certificates matching subdomains.","description_kind":"plain","optional":true},"allow_wildcard_certificates":{"type":"bool","description":"Flag to allow wildcard certificates","description_kind":"plain","optional":true},"allowed_domains":{"type":["list","string"],"description":"The domains of the role.","description_kind":"plain","optional":true},"allowed_domains_template":{"type":"bool","description":"Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.\u003cmount accessor\u003e.name}})","description_kind":"plain","optional":true},"allowed_other_sans":{"type":["list","string"],"description":"Defines allowed custom SANs","description_kind":"plain","optional":true},"allowed_serial_numbers":{"type":["list","string"],"description":"Defines allowed Subject serial numbers.","description_kind":"plain","optional":true},"allowed_uri_sans":{"type":["list","string"],"description":"Defines allowed URI SANs","description_kind":"plain","optional":true},"allowed_uri_sans_template":{"type":"bool","description":"Flag to indicate that `allowed_uri_sans` specifies a template expression (e.g. {{identity.entity.aliases.\u003cmount accessor\u003e.name}})","description_kind":"plain","optional":true,"computed":true},"allowed_user_ids":{"type":["list","string"],"description":"The allowed User ID's.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The path of the PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"basic_constraints_valid_for_non_ca":{"type":"bool","description":"Flag to mark basic constraints valid when issuing non-CA certificates.","description_kind":"plain","optional":true},"client_flag":{"type":"bool","description":"Flag to specify certificates for client use.","description_kind":"plain","optional":true},"code_signing_flag":{"type":"bool","description":"Flag to specify certificates for code signing use.","description_kind":"plain","optional":true},"country":{"type":["list","string"],"description":"The country of generated certificates.","description_kind":"plain","optional":true},"email_protection_flag":{"type":"bool","description":"Flag to specify certificates for email protection use.","description_kind":"plain","optional":true},"enforce_hostnames":{"type":"bool","description":"Flag to allow only valid host names","description_kind":"plain","optional":true},"ext_key_usage":{"type":["list","string"],"description":"Specify the allowed extended key usage constraint on issued certificates.","description_kind":"plain","optional":true},"ext_key_usage_oids":{"type":["list","string"],"description":"A list of extended key usage OIDs.","description_kind":"plain","optional":true},"generate_lease":{"type":"bool","description":"Flag to generate leases with certificates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer_ref":{"type":"string","description":"Specifies the default issuer of this request.","description_kind":"plain","optional":true,"computed":true},"key_bits":{"type":"number","description":"The number of bits of generated keys.","description_kind":"plain","optional":true},"key_type":{"type":"string","description":"The generated key type.","description_kind":"plain","optional":true},"key_usage":{"type":["list","string"],"description":"Specify the allowed key usage constraint on issued certificates.","description_kind":"plain","optional":true,"computed":true},"locality":{"type":["list","string"],"description":"The locality of generated certificates.","description_kind":"plain","optional":true},"max_ttl":{"type":"string","description":"The maximum TTL.","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name for the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"no_store":{"type":"bool","description":"Flag to not store certificates in the storage backend.","description_kind":"plain","optional":true},"not_before_duration":{"type":"string","description":"Specifies the duration by which to backdate the NotBefore property.","description_kind":"plain","optional":true,"computed":true},"organization":{"type":["list","string"],"description":"The organization of generated certificates.","description_kind":"plain","optional":true},"ou":{"type":["list","string"],"description":"The organization unit of generated certificates.","description_kind":"plain","optional":true},"policy_identifiers":{"type":["list","string"],"description":"Specify the list of allowed policies OIDs.","description_kind":"plain","optional":true},"postal_code":{"type":["list","string"],"description":"The postal code of generated certificates.","description_kind":"plain","optional":true},"province":{"type":["list","string"],"description":"The province of generated certificates.","description_kind":"plain","optional":true},"require_cn":{"type":"bool","description":"Flag to force CN usage.","description_kind":"plain","optional":true},"server_flag":{"type":"bool","description":"Flag to specify certificates for server use.","description_kind":"plain","optional":true},"street_address":{"type":["list","string"],"description":"The street address of generated certificates.","description_kind":"plain","optional":true},"ttl":{"type":"string","description":"The TTL.","description_kind":"plain","optional":true,"computed":true},"use_csr_common_name":{"type":"bool","description":"Flag to use the CN in the CSR.","description_kind":"plain","optional":true},"use_csr_sans":{"type":"bool","description":"Flag to use the SANs in the CSR.","description_kind":"plain","optional":true}},"block_types":{"policy_identifier":{"nesting_mode":"set","block":{"attributes":{"cps":{"type":"string","description":"Optional CPS URL","description_kind":"plain","optional":true},"notice":{"type":"string","description":"Optional notice","description_kind":"plain","optional":true},"oid":{"type":"string","description":"OID","description_kind":"plain","required":true}},"description":"Policy identifier block; can only be used with Vault 1.11+","description_kind":"plain"}}},"description_kind":"plain"}},"vault_pki_secret_backend_root_cert":{"version":1,"block":{"attributes":{"alt_names":{"type":["list","string"],"description":"List of alternative names.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"certificate":{"type":"string","description":"The certificate.","description_kind":"plain","computed":true},"common_name":{"type":"string","description":"CN of root to create.","description_kind":"plain","required":true},"country":{"type":"string","description":"The country.","description_kind":"plain","optional":true},"exclude_cn_from_sans":{"type":"bool","description":"Flag to exclude CN from SANs.","description_kind":"plain","optional":true},"format":{"type":"string","description":"The format of data.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_sans":{"type":["list","string"],"description":"List of alternative IPs.","description_kind":"plain","optional":true},"issuer_id":{"type":"string","description":"The ID of the generated issuer.","description_kind":"plain","computed":true},"issuer_name":{"type":"string","description":"Provides a name to the specified issuer. The name must be unique across all issuers and not be the reserved value 'default'.","description_kind":"plain","optional":true,"computed":true},"issuing_ca":{"type":"string","description":"The issuing CA.","description_kind":"plain","computed":true},"key_bits":{"type":"number","description":"The number of bits to use.","description_kind":"plain","optional":true},"key_id":{"type":"string","description":"The ID of the generated key.","description_kind":"plain","computed":true},"key_name":{"type":"string","description":"When a new key is created with this request, optionally specifies the name for this.","description_kind":"plain","optional":true,"computed":true},"key_ref":{"type":"string","description":"Specifies the key to use for generating this request.","description_kind":"plain","optional":true,"computed":true},"key_type":{"type":"string","description":"The desired key type.","description_kind":"plain","optional":true},"locality":{"type":"string","description":"The locality.","description_kind":"plain","optional":true},"managed_key_id":{"type":"string","description":"The ID of the previously configured managed key.","description_kind":"plain","optional":true,"computed":true},"managed_key_name":{"type":"string","description":"The name of the previously configured managed key.","description_kind":"plain","optional":true,"computed":true},"max_path_length":{"type":"number","description":"The maximum path length to encode in the generated certificate.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"The organization.","description_kind":"plain","optional":true},"other_sans":{"type":["list","string"],"description":"List of other SANs.","description_kind":"plain","optional":true},"ou":{"type":"string","description":"The organization unit.","description_kind":"plain","optional":true},"permitted_dns_domains":{"type":["list","string"],"description":"List of domains for which certificates are allowed to be issued.","description_kind":"plain","optional":true},"postal_code":{"type":"string","description":"The postal code.","description_kind":"plain","optional":true},"private_key_format":{"type":"string","description":"The private key format.","description_kind":"plain","optional":true},"province":{"type":"string","description":"The province.","description_kind":"plain","optional":true},"serial":{"type":"string","description":"The serial number.","description_kind":"plain","deprecated":true,"computed":true},"serial_number":{"type":"string","description":"The certificate's serial number, hex formatted.","description_kind":"plain","computed":true},"street_address":{"type":"string","description":"The street address.","description_kind":"plain","optional":true},"ttl":{"type":"string","description":"Time to live.","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of root to create. Must be either \"existing\", \"exported\", \"internal\" or \"kms\"","description_kind":"plain","required":true},"uri_sans":{"type":["list","string"],"description":"List of alternative URIs.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_root_sign_intermediate":{"version":2,"block":{"attributes":{"alt_names":{"type":["list","string"],"description":"List of alternative names.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"ca_chain":{"type":["list","string"],"description":"The CA chain as a list of format specific certificates","description_kind":"plain","computed":true},"certificate":{"type":"string","description":"The signed intermediate CA certificate.","description_kind":"plain","computed":true},"certificate_bundle":{"type":"string","description":"The concatenation of the intermediate and issuing CA certificates (PEM encoded). Requires the format to be set to any of: pem, pem_bundle. The value will be empty for all other formats.","description_kind":"plain","computed":true},"common_name":{"type":"string","description":"CN of intermediate to create.","description_kind":"plain","required":true},"country":{"type":"string","description":"The country.","description_kind":"plain","optional":true},"csr":{"type":"string","description":"The CSR.","description_kind":"plain","required":true},"exclude_cn_from_sans":{"type":"bool","description":"Flag to exclude CN from SANs.","description_kind":"plain","optional":true},"format":{"type":"string","description":"The format of data.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_sans":{"type":["list","string"],"description":"List of alternative IPs.","description_kind":"plain","optional":true},"issuer_ref":{"type":"string","description":"Specifies the default issuer of this request.","description_kind":"plain","optional":true},"issuing_ca":{"type":"string","description":"The issuing CA certificate.","description_kind":"plain","computed":true},"locality":{"type":"string","description":"The locality.","description_kind":"plain","optional":true},"max_path_length":{"type":"number","description":"The maximum path length to encode in the generated certificate.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"The organization.","description_kind":"plain","optional":true},"other_sans":{"type":["list","string"],"description":"List of other SANs.","description_kind":"plain","optional":true},"ou":{"type":"string","description":"The organization unit.","description_kind":"plain","optional":true},"permitted_dns_domains":{"type":["list","string"],"description":"List of domains for which certificates are allowed to be issued.","description_kind":"plain","optional":true},"postal_code":{"type":"string","description":"The postal code.","description_kind":"plain","optional":true},"province":{"type":"string","description":"The province.","description_kind":"plain","optional":true},"revoke":{"type":"bool","description":"Revoke the certificate upon resource destruction.","description_kind":"plain","optional":true},"serial":{"type":"string","description":"The serial number.","description_kind":"plain","deprecated":true,"computed":true},"serial_number":{"type":"string","description":"The certificate's serial number, hex formatted.","description_kind":"plain","computed":true},"street_address":{"type":"string","description":"The street address.","description_kind":"plain","optional":true},"ttl":{"type":"string","description":"Time to live.","description_kind":"plain","optional":true},"uri_sans":{"type":["list","string"],"description":"List of alternative URIs.","description_kind":"plain","optional":true},"use_csr_values":{"type":"bool","description":"Preserve CSR values.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_sign":{"version":1,"block":{"attributes":{"alt_names":{"type":["list","string"],"description":"List of alternative names.","description_kind":"plain","optional":true},"auto_renew":{"type":"bool","description":"If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining","description_kind":"plain","optional":true},"backend":{"type":"string","description":"The PKI secret backend the resource belongs to.","description_kind":"plain","required":true},"ca_chain":{"type":["list","string"],"description":"The CA chain.","description_kind":"plain","computed":true},"certificate":{"type":"string","description":"The certicate.","description_kind":"plain","computed":true},"common_name":{"type":"string","description":"CN of intermediate to create.","description_kind":"plain","required":true},"csr":{"type":"string","description":"The CSR.","description_kind":"plain","required":true},"exclude_cn_from_sans":{"type":"bool","description":"Flag to exclude CN from SANs.","description_kind":"plain","optional":true},"expiration":{"type":"number","description":"The certificate expiration as a Unix-style timestamp.","description_kind":"plain","computed":true},"format":{"type":"string","description":"The format of data.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"ip_sans":{"type":["list","string"],"description":"List of alternative IPs.","description_kind":"plain","optional":true},"issuer_ref":{"type":"string","description":"Specifies the default issuer of this request.","description_kind":"plain","optional":true},"issuing_ca":{"type":"string","description":"The issuing CA.","description_kind":"plain","computed":true},"min_seconds_remaining":{"type":"number","description":"Generate a new certificate when the expiration is within this number of seconds","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the role to create the certificate against.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"other_sans":{"type":["list","string"],"description":"List of other SANs.","description_kind":"plain","optional":true},"renew_pending":{"type":"bool","description":"Initially false, and then set to true during refresh once the expiration is less than min_seconds_remaining in the future.","description_kind":"plain","computed":true},"serial":{"type":"string","description":"The serial number.","description_kind":"plain","deprecated":true,"computed":true},"serial_number":{"type":"string","description":"The certificate's serial number, hex formatted.","description_kind":"plain","computed":true},"ttl":{"type":"string","description":"Time to live.","description_kind":"plain","optional":true},"uri_sans":{"type":["list","string"],"description":"List of alternative URIs.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_policy":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the policy","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policy":{"type":"string","description":"The policy document","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_quota_lease_count":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_leases":{"type":"number","description":"The maximum number of leases to be allowed by the quota rule. The max_leases must be positive.","description_kind":"plain","required":true},"name":{"type":"string","description":"The name of the quota.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path of the mount or namespace to apply the quota. A blank path configures a global lease count quota.","description_kind":"plain","optional":true},"role":{"type":"string","description":"If set on a quota where path is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_quota_rate_limit":{"version":0,"block":{"attributes":{"block_interval":{"type":"number","description":"If set, when a client reaches a rate limit threshold, the client will be prohibited from any further requests until after the 'block_interval' in seconds has elapsed.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"interval":{"type":"number","description":"The duration in seconds to enforce rate limiting for.","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the quota.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path of the mount or namespace to apply the quota. A blank path configures a global rate limit quota.","description_kind":"plain","optional":true},"rate":{"type":"number","description":"The maximum number of requests at any given second to be allowed by the quota rule. The rate must be positive.","description_kind":"plain","required":true},"role":{"type":"string","description":"If set on a quota where path is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_rabbitmq_secret_backend":{"version":1,"block":{"attributes":{"connection_uri":{"type":"string","description":"Specifies the RabbitMQ connection URI.","description_kind":"plain","required":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true,"computed":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"password":{"type":"string","description":"Specifies the RabbitMQ management administrator password","description_kind":"plain","required":true,"sensitive":true},"password_policy":{"type":"string","description":"Specifies a password policy to use when creating dynamic credentials. Defaults to generating an alphanumeric password if not set.","description_kind":"plain","optional":true},"path":{"type":"string","description":"The path of the RabbitMQ Secret Backend where the connection should be configured","description_kind":"plain","optional":true},"username":{"type":"string","description":"Specifies the RabbitMQ management administrator username","description_kind":"plain","required":true,"sensitive":true},"username_template":{"type":"string","description":"Template describing how dynamic usernames are generated.","description_kind":"plain","optional":true},"verify_connection":{"type":"bool","description":"Specifies whether to verify connection URI, username, and password.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_rabbitmq_secret_backend_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the Rabbitmq Secret Backend the role belongs to.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name for the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"tags":{"type":"string","description":"Specifies a comma-separated RabbitMQ management tags.","description_kind":"plain","optional":true}},"block_types":{"vhost":{"nesting_mode":"list","block":{"attributes":{"configure":{"type":"string","description":"The configure permissions for this vhost.","description_kind":"plain","required":true},"host":{"type":"string","description":"The vhost to set permissions for.","description_kind":"plain","required":true},"read":{"type":"string","description":"The read permissions for this vhost.","description_kind":"plain","required":true},"write":{"type":"string","description":"The write permissions for this vhost.","description_kind":"plain","required":true}},"description":"Specifies a map of virtual hosts to permissions.","description_kind":"plain"}},"vhost_topic":{"nesting_mode":"list","block":{"attributes":{"host":{"type":"string","description":"The vhost to set permissions for.","description_kind":"plain","required":true}},"block_types":{"vhost":{"nesting_mode":"list","block":{"attributes":{"read":{"type":"string","description":"The read permissions for this vhost.","description_kind":"plain","required":true},"topic":{"type":"string","description":"The vhost to set permissions for.","description_kind":"plain","required":true},"write":{"type":"string","description":"The write permissions for this vhost.","description_kind":"plain","required":true}},"description":"Specifies a map of virtual hosts to permissions.","description_kind":"plain"}}},"description":"Specifies a map of virtual hosts and exchanges to topic permissions. This option requires RabbitMQ 3.7.0 or later.","description_kind":"plain"}}},"description_kind":"plain"}},"vault_raft_autopilot":{"version":0,"block":{"attributes":{"cleanup_dead_servers":{"type":"bool","description":"Specifies whether to remove dead server nodes periodically or when a new server joins. This requires that min-quorum is also set.","description_kind":"plain","optional":true},"dead_server_last_contact_threshold":{"type":"string","description":"Limit the amount of time a server can go without leader contact before being considered failed. This only takes effect when cleanup_dead_servers is set.","description_kind":"plain","optional":true},"disable_upgrade_migration":{"type":"bool","description":"Disables automatically upgrading Vault using autopilot. (Enterprise-only)","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"last_contact_threshold":{"type":"string","description":"Limit the amount of time a server can go without leader contact before being considered unhealthy.","description_kind":"plain","optional":true},"max_trailing_logs":{"type":"number","description":"Maximum number of log entries in the Raft log that a server can be behind its leader before being considered unhealthy.","description_kind":"plain","optional":true},"min_quorum":{"type":"number","description":"Minimum number of servers allowed in a cluster before autopilot can prune dead servers. This should at least be 3. Applicable only for voting nodes.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"server_stabilization_time":{"type":"string","description":"Minimum amount of time a server must be stable in the 'healthy' state before being added to the cluster.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_raft_snapshot_agent_config":{"version":0,"block":{"attributes":{"aws_access_key_id":{"type":"string","description":"AWS access key ID.","description_kind":"plain","optional":true},"aws_s3_bucket":{"type":"string","description":"S3 bucket to write snapshots to.","description_kind":"plain","optional":true},"aws_s3_disable_tls":{"type":"bool","description":"Disable TLS for the S3 endpoint. This should only be used for testing purposes.","description_kind":"plain","optional":true},"aws_s3_enable_kms":{"type":"bool","description":"Use KMS to encrypt bucket contents.","description_kind":"plain","optional":true},"aws_s3_endpoint":{"type":"string","description":"AWS endpoint. This is typically only set when using a non-AWS S3 implementation like Minio.","description_kind":"plain","optional":true},"aws_s3_force_path_style":{"type":"bool","description":"Use the endpoint/bucket URL style instead of bucket.endpoint.","description_kind":"plain","optional":true},"aws_s3_kms_key":{"type":"string","description":"Use named KMS key, when aws_s3_enable_kms=true","description_kind":"plain","optional":true},"aws_s3_region":{"type":"string","description":"AWS region bucket is in.","description_kind":"plain","optional":true},"aws_s3_server_side_encryption":{"type":"bool","description":"Use AES256 to encrypt bucket contents.","description_kind":"plain","optional":true},"aws_secret_access_key":{"type":"string","description":"AWS secret access key.","description_kind":"plain","optional":true},"aws_session_token":{"type":"string","description":"AWS session token.","description_kind":"plain","optional":true},"azure_account_key":{"type":"string","description":"Azure account key.","description_kind":"plain","optional":true},"azure_account_name":{"type":"string","description":"Azure account name.","description_kind":"plain","optional":true},"azure_blob_environment":{"type":"string","description":"Azure blob environment.","description_kind":"plain","optional":true},"azure_container_name":{"type":"string","description":"Azure container name to write snapshots to.","description_kind":"plain","optional":true},"azure_endpoint":{"type":"string","description":"Azure blob storage endpoint. This is typically only set when using a non-Azure implementation like Azurite.","description_kind":"plain","optional":true},"file_prefix":{"type":"string","description":"The file or object name of snapshot files will start with this string.","description_kind":"plain","optional":true},"google_disable_tls":{"type":"bool","description":"Disable TLS for the GCS endpoint.","description_kind":"plain","optional":true},"google_endpoint":{"type":"string","description":"GCS endpoint. This is typically only set when using a non-Google GCS implementation like fake-gcs-server.","description_kind":"plain","optional":true},"google_gcs_bucket":{"type":"string","description":"GCS bucket to write snapshots to.","description_kind":"plain","optional":true},"google_service_account_key":{"type":"string","description":"Google service account key in JSON format.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"interval_seconds":{"type":"number","description":"Number of seconds between snapshots.","description_kind":"plain","required":true},"local_max_space":{"type":"number","description":"The maximum space, in bytes, to use for snapshots.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the snapshot agent configuration.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path_prefix":{"type":"string","description":"The directory or bucket prefix to to use.","description_kind":"plain","required":true},"retain":{"type":"number","description":"How many snapshots are to be kept.","description_kind":"plain","optional":true},"storage_type":{"type":"string","description":"What storage service to send snapshots to. One of \"local\", \"azure-blob\", \"aws-s3\", or \"google-gcs\".","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_rgp_policy":{"version":0,"block":{"attributes":{"enforcement_level":{"type":"string","description":"Enforcement level of Sentinel policy. Can be one of: 'advisory', 'soft-mandatory' or 'hard-mandatory'","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the policy","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"policy":{"type":"string","description":"The policy document","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_saml_auth_backend":{"version":0,"block":{"attributes":{"acs_urls":{"type":["list","string"],"description":"The well-formatted URLs of your Assertion Consumer Service (ACS) that should receive a response from the identity provider.","description_kind":"plain","required":true},"default_role":{"type":"string","description":"The role to use if no role is provided during login.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"entity_id":{"type":"string","description":"The entity ID of the SAML authentication service provider.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"idp_cert":{"type":"string","description":"The PEM encoded certificate of the identity provider. Mutually exclusive with 'idp_metadata_url'","description_kind":"plain","optional":true},"idp_entity_id":{"type":"string","description":"The entity ID of the identity provider. Mutually exclusive with 'idp_metadata_url'.","description_kind":"plain","optional":true},"idp_metadata_url":{"type":"string","description":"The metadata URL of the identity provider.","description_kind":"plain","optional":true},"idp_sso_url":{"type":"string","description":"The SSO URL of the identity provider. Mutually exclusive with 'idp_metadata_url'.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"verbose_logging":{"type":"bool","description":"Log additional, potentially sensitive information during the SAML exchange according to the current logging level. Not recommended for production.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_saml_auth_backend_role":{"version":0,"block":{"attributes":{"bound_attributes":{"type":["map","string"],"description":"Mapping of attribute names to values that are expected to exist in the SAML assertion.","description_kind":"plain","optional":true},"bound_attributes_type":{"type":"string","description":"The type of matching assertion to perform on bound_attributes.","description_kind":"plain","optional":true,"computed":true},"bound_subjects":{"type":["list","string"],"description":"The subject being asserted for SAML authentication.","description_kind":"plain","optional":true},"bound_subjects_type":{"type":"string","description":"The type of matching assertion to perform on bound_subjects.","description_kind":"plain","optional":true,"computed":true},"groups_attribute":{"type":"string","description":"The attribute to use to identify the set of groups to which the user belongs.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name of the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path where SAML Auth engine is mounted.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_secrets_sync_association":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Specifies the mount where the secret is located.","description_kind":"plain","required":true},"name":{"type":"string","description":"Name of the destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_name":{"type":"string","description":"Specifies the name of the secret to synchronize.","description_kind":"plain","required":true},"sync_status":{"type":"string","description":"Specifies the status of the association.","description_kind":"plain","computed":true},"type":{"type":"string","description":"Type of sync destination.","description_kind":"plain","required":true},"updated_at":{"type":"string","description":"Duration string stating when the secret was last updated.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_secrets_sync_aws_destination":{"version":0,"block":{"attributes":{"access_key_id":{"type":"string","description":"Access key id to authenticate against the AWS secrets manager.","description_kind":"plain","optional":true},"custom_tags":{"type":["map","string"],"description":"Custom tags to set on the secret managed at the destination.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name of the AWS destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"region":{"type":"string","description":"Region where to manage the secrets manager entries.","description_kind":"plain","optional":true},"secret_access_key":{"type":"string","description":"Secret access key to authenticate against the AWS secrets manager.","description_kind":"plain","optional":true,"sensitive":true},"secret_name_template":{"type":"string","description":"Template describing how to generate external secret names.","description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of secrets destination.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_secrets_sync_azure_destination":{"version":0,"block":{"attributes":{"client_id":{"type":"string","description":"Client ID of an Azure app registration.","description_kind":"plain","optional":true},"client_secret":{"type":"string","description":"Client Secret of an Azure app registration.","description_kind":"plain","optional":true,"sensitive":true},"cloud":{"type":"string","description":"Specifies a cloud for the client.","description_kind":"plain","optional":true},"custom_tags":{"type":["map","string"],"description":"Custom tags to set on the secret managed at the destination.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_vault_uri":{"type":"string","description":"URI of an existing Azure Key Vault instance.","description_kind":"plain","optional":true},"name":{"type":"string","description":"Unique name of the Azure destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_name_template":{"type":"string","description":"Template describing how to generate external secret names.","description_kind":"plain","optional":true,"computed":true},"tenant_id":{"type":"string","description":"ID of the target Azure tenant.","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of secrets destination.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_secrets_sync_config":{"version":0,"block":{"attributes":{"disabled":{"type":"bool","description":"Disables the syncing process between Vault and external destinations.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"queue_capacity":{"type":"number","description":"Maximum number of pending sync operations allowed on the queue.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_secrets_sync_gcp_destination":{"version":0,"block":{"attributes":{"credentials":{"type":"string","description":"JSON-encoded credentials to use to connect to GCP.","description_kind":"plain","optional":true,"sensitive":true},"custom_tags":{"type":["map","string"],"description":"Custom tags to set on the secret managed at the destination.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name of the GCP destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_name_template":{"type":"string","description":"Template describing how to generate external secret names.","description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of secrets destination.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_secrets_sync_gh_destination":{"version":0,"block":{"attributes":{"access_token":{"type":"string","description":"Fine-grained or personal access token.","description_kind":"plain","optional":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name of the github destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"repository_name":{"type":"string","description":"Name of the repository.","description_kind":"plain","optional":true},"repository_owner":{"type":"string","description":"GitHub organization or username that owns the repository.","description_kind":"plain","optional":true},"secret_name_template":{"type":"string","description":"Template describing how to generate external secret names.","description_kind":"plain","optional":true,"computed":true},"type":{"type":"string","description":"Type of secrets destination.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_secrets_sync_vercel_destination":{"version":0,"block":{"attributes":{"access_token":{"type":"string","description":"Vercel API access token with the permissions to manage environment variables.","description_kind":"plain","required":true,"sensitive":true},"deployment_environments":{"type":["list","string"],"description":"Deployment environments where the environment variables are available. Accepts 'development', 'preview' \u0026 'production'.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name of the Vercel destination.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"project_id":{"type":"string","description":"Project ID where to manage environment variables.","description_kind":"plain","required":true},"secret_name_template":{"type":"string","description":"Template describing how to generate external secret names.","description_kind":"plain","optional":true,"computed":true},"team_id":{"type":"string","description":"Team ID the project belongs to.","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of secrets destination.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_ssh_secret_backend_ca":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the SSH Secret Backend where the CA should be configured","description_kind":"plain","optional":true},"generate_signing_key":{"type":"bool","description":"Whether Vault should generate the signing key pair internally.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"private_key":{"type":"string","description":"Private key part the SSH CA key pair; required if generate_signing_key is false.","description_kind":"plain","optional":true,"computed":true,"sensitive":true},"public_key":{"type":"string","description":"Public key part the SSH CA key pair; required if generate_signing_key is false.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_ssh_secret_backend_role":{"version":0,"block":{"attributes":{"algorithm_signer":{"type":"string","description_kind":"plain","optional":true,"computed":true},"allow_bare_domains":{"type":"bool","description_kind":"plain","optional":true},"allow_host_certificates":{"type":"bool","description_kind":"plain","optional":true},"allow_subdomains":{"type":"bool","description_kind":"plain","optional":true},"allow_user_certificates":{"type":"bool","description_kind":"plain","optional":true},"allow_user_key_ids":{"type":"bool","description_kind":"plain","optional":true},"allowed_critical_options":{"type":"string","description_kind":"plain","optional":true},"allowed_domains":{"type":"string","description_kind":"plain","optional":true},"allowed_domains_template":{"type":"bool","description_kind":"plain","optional":true,"computed":true},"allowed_extensions":{"type":"string","description_kind":"plain","optional":true},"allowed_user_key_lengths":{"type":["map","number"],"description_kind":"plain","deprecated":true,"optional":true},"allowed_users":{"type":"string","description_kind":"plain","optional":true},"allowed_users_template":{"type":"bool","description_kind":"plain","optional":true},"backend":{"type":"string","description_kind":"plain","required":true},"cidr_list":{"type":"string","description_kind":"plain","optional":true},"default_critical_options":{"type":["map","string"],"description_kind":"plain","optional":true},"default_extensions":{"type":["map","string"],"description_kind":"plain","optional":true},"default_user":{"type":"string","description_kind":"plain","optional":true},"default_user_template":{"type":"bool","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_id_format":{"type":"string","description_kind":"plain","optional":true},"key_type":{"type":"string","description_kind":"plain","required":true},"max_ttl":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Unique name for the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"not_before_duration":{"type":"string","description":"Specifies the duration by which to backdate the ValidAfter property. Uses duration format strings.","description_kind":"plain","optional":true,"computed":true},"ttl":{"type":"string","description_kind":"plain","optional":true,"computed":true}},"block_types":{"allowed_user_key_config":{"nesting_mode":"set","block":{"attributes":{"lengths":{"type":["list","number"],"description":"List of allowed key lengths, vault-1.10 and above","description_kind":"plain","required":true},"type":{"type":"string","description":"Key type, choices:\nrsa, ecdsa, ec, dsa, ed25519, ssh-rsa, ssh-dss, ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521","description_kind":"plain","required":true}},"description":"Set of allowed public key types and their relevant configuration","description_kind":"plain"}}},"description_kind":"plain"}},"vault_terraform_cloud_secret_backend":{"version":1,"block":{"attributes":{"address":{"type":"string","description":"Specifies the address of the Terraform Cloud instance, provided as \"host:port\" like \"127.0.0.1:8500\".","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the Vault Terraform Cloud mount to configure","description_kind":"plain","optional":true},"base_path":{"type":"string","description":"Specifies the base path for the Terraform Cloud or Enterprise API.","description_kind":"plain","optional":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration for secrets in seconds","description_kind":"plain","optional":true},"description":{"type":"string","description":"Human-friendly description of the mount for the backend.","description_kind":"plain","optional":true},"disable_remount":{"type":"bool","description":"If set, opts out of mount migration on path updates.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration for secrets in seconds","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"token":{"type":"string","description":"Specifies the Terraform Cloud access token to use.","description_kind":"plain","optional":true,"sensitive":true}},"description_kind":"plain"}},"vault_terraform_cloud_secret_creds":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Terraform Cloud secret backend to generate tokens from","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_id":{"type":"string","description":"Associated Vault lease ID, if one exists","description_kind":"plain","computed":true,"sensitive":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"Name of the Terraform Cloud or Enterprise organization","description_kind":"plain","computed":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"team_id":{"type":"string","description":"ID of the Terraform Cloud or Enterprise team under organization (e.g., settings/teams/team-xxxxxxxxxxxxx)","description_kind":"plain","computed":true},"token":{"type":"string","description":"Terraform Token provided by the Vault backend","description_kind":"plain","computed":true,"sensitive":true},"token_id":{"type":"string","description":"ID of the Terraform Token provided","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_terraform_cloud_secret_role":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The path of the Terraform Cloud Secret Backend the role belongs to.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"max_ttl":{"type":"number","description":"Maximum allowed lease for generated credentials. If not set or set to 0, will use system default.","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of an existing role against which to create this Terraform Cloud credential","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"organization":{"type":"string","description":"Name of the Terraform Cloud or Enterprise organization","description_kind":"plain","optional":true},"team_id":{"type":"string","description":"ID of the Terraform Cloud or Enterprise team under organization (e.g., settings/teams/team-xxxxxxxxxxxxx)","description_kind":"plain","optional":true},"ttl":{"type":"number","description":"Default lease for generated credentials. If not set or set to 0, will use system default.","description_kind":"plain","optional":true},"user_id":{"type":"string","description":"ID of the Terraform Cloud or Enterprise user (e.g., user-xxxxxxxxxxxxxxxx)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_token":{"version":0,"block":{"attributes":{"client_token":{"type":"string","description":"The client token.","description_kind":"plain","computed":true,"sensitive":true},"display_name":{"type":"string","description":"The display name of the token.","description_kind":"plain","optional":true},"explicit_max_ttl":{"type":"string","description":"The explicit max TTL of the token.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"The token lease duration.","description_kind":"plain","computed":true},"lease_started":{"type":"string","description":"The token lease started on.","description_kind":"plain","computed":true},"metadata":{"type":["map","string"],"description":"Metadata to be associated with the token.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"no_default_policy":{"type":"bool","description":"Flag to disable the default policy.","description_kind":"plain","optional":true},"no_parent":{"type":"bool","description":"Flag to create a token without parent.","description_kind":"plain","optional":true,"computed":true},"num_uses":{"type":"number","description":"The number of allowed uses of the token.","description_kind":"plain","optional":true,"computed":true},"period":{"type":"string","description":"The period of the token.","description_kind":"plain","optional":true},"policies":{"type":["set","string"],"description":"List of policies.","description_kind":"plain","optional":true},"renew_increment":{"type":"number","description":"The renew increment.","description_kind":"plain","optional":true},"renew_min_lease":{"type":"number","description":"The minimum lease to renew token.","description_kind":"plain","optional":true},"renewable":{"type":"bool","description":"Flag to allow the token to be renewed","description_kind":"plain","optional":true,"computed":true},"role_name":{"type":"string","description":"The token role name.","description_kind":"plain","optional":true},"ttl":{"type":"string","description":"The TTL period of the token.","description_kind":"plain","optional":true},"wrapped_token":{"type":"string","description":"The client wrapped token.","description_kind":"plain","computed":true,"sensitive":true},"wrapping_accessor":{"type":"string","description":"The client wrapping accessor.","description_kind":"plain","computed":true,"sensitive":true},"wrapping_ttl":{"type":"string","description":"The TTL period of the wrapped token.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_token_auth_backend_role":{"version":0,"block":{"attributes":{"allowed_entity_aliases":{"type":["set","string"],"description":"Set of allowed entity aliases for this role.","description_kind":"plain","optional":true},"allowed_policies":{"type":["set","string"],"description":"List of allowed policies for given role.","description_kind":"plain","optional":true},"allowed_policies_glob":{"type":["set","string"],"description":"Set of allowed policies with glob match for given role.","description_kind":"plain","optional":true},"disallowed_policies":{"type":["set","string"],"description":"List of disallowed policies for given role.","description_kind":"plain","optional":true},"disallowed_policies_glob":{"type":["set","string"],"description":"Set of disallowed policies with glob match for given role.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"orphan":{"type":"bool","description":"If true, tokens created against this policy will be orphan tokens.","description_kind":"plain","optional":true},"path_suffix":{"type":"string","description":"Tokens created against this role will have the given suffix as part of their path in addition to the role name.","description_kind":"plain","optional":true},"renewable":{"type":"bool","description":"Whether to disable the ability of the token to be renewed past its initial TTL.","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transform_alphabet":{"version":0,"block":{"attributes":{"alphabet":{"type":"string","description":"A string of characters that contains the alphabet set.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the alphabet.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"The mount path for a back-end, for example, the path given in \"$ vault auth enable -path=my-aws aws\".","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_transform_role":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"The mount path for a back-end, for example, the path given in \"$ vault auth enable -path=my-aws aws\".","description_kind":"plain","required":true},"transformations":{"type":["list","string"],"description":"A comma separated string or slice of transformations to use.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transform_template":{"version":0,"block":{"attributes":{"alphabet":{"type":"string","description":"The alphabet to use for this template. This is only used during FPE transformations.","description_kind":"plain","optional":true},"decode_formats":{"type":["map","string"],"description":"The map of regular expression templates used to customize decoded outputs.\nOnly applicable to FPE transformations.","description_kind":"plain","optional":true},"encode_format":{"type":"string","description":"The regular expression template used for encoding values.\nOnly applicable to FPE transformations.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the template.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"The mount path for a back-end, for example, the path given in \"$ vault auth enable -path=my-aws aws\".","description_kind":"plain","required":true},"pattern":{"type":"string","description":"The pattern used for matching. Currently, only regular expression pattern is supported.","description_kind":"plain","optional":true},"type":{"type":"string","description":"The pattern type to use for match detection. Currently, only regex is supported.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transform_transformation":{"version":0,"block":{"attributes":{"allowed_roles":{"type":["list","string"],"description":"The set of roles allowed to perform this transformation.","description_kind":"plain","optional":true},"deletion_allowed":{"type":"bool","description":"If true, this transform can be deleted. Otherwise deletion is blocked while this value remains false.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"masking_character":{"type":"string","description":"The character used to replace data when in masking mode","description_kind":"plain","optional":true},"name":{"type":"string","description":"The name of the transformation.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"The mount path for a back-end, for example, the path given in \"$ vault auth enable -path=my-aws aws\".","description_kind":"plain","required":true},"template":{"type":"string","description":"The name of the template to use.","description_kind":"plain","optional":true},"templates":{"type":["list","string"],"description":"Templates configured for transformation.","description_kind":"plain","optional":true,"computed":true},"tweak_source":{"type":"string","description":"The source of where the tweak value comes from. Only valid when in FPE mode.","description_kind":"plain","optional":true},"type":{"type":"string","description":"The type of transformation to perform.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transit_secret_backend_key":{"version":0,"block":{"attributes":{"allow_plaintext_backup":{"type":"bool","description":"If set, enables taking backup of named key in the plaintext format. Once set, this cannot be disabled.","description_kind":"plain","optional":true},"auto_rotate_interval":{"type":"number","description":"Amount of time the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key.","description_kind":"plain","deprecated":true,"optional":true,"computed":true},"auto_rotate_period":{"type":"number","description":"Amount of seconds the key should live before being automatically rotated. A value of 0 disables automatic rotation for the key.","description_kind":"plain","optional":true,"computed":true},"backend":{"type":"string","description":"The Transit secret backend the resource belongs to.","description_kind":"plain","required":true},"convergent_encryption":{"type":"bool","description":"Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires derived to be set to true.","description_kind":"plain","optional":true},"deletion_allowed":{"type":"bool","description":"Specifies if the key is allowed to be deleted.","description_kind":"plain","optional":true},"derived":{"type":"bool","description":"Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.","description_kind":"plain","optional":true},"exportable":{"type":"bool","description":"Enables keys to be exportable. This allows for all the valid keys in the key ring to be exported. Once set, this cannot be disabled.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_size":{"type":"number","description":"The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC; this value must be between 32 and 512.","description_kind":"plain","optional":true},"keys":{"type":["list",["map","string"]],"description":"List of key versions in the keyring.","description_kind":"plain","computed":true},"latest_version":{"type":"number","description":"Latest key version in use in the keyring","description_kind":"plain","computed":true},"min_available_version":{"type":"number","description":"Minimum key version available for use.","description_kind":"plain","computed":true},"min_decryption_version":{"type":"number","description":"Minimum key version to use for decryption.","description_kind":"plain","optional":true},"min_encryption_version":{"type":"number","description":"Minimum key version to use for encryption","description_kind":"plain","optional":true},"name":{"type":"string","description":"Name of the encryption key to create.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"supports_decryption":{"type":"bool","description":"Whether or not the key supports decryption, based on key type.","description_kind":"plain","computed":true},"supports_derivation":{"type":"bool","description":"Whether or not the key supports derivation, based on key type.","description_kind":"plain","computed":true},"supports_encryption":{"type":"bool","description":"Whether or not the key supports encryption, based on key type.","description_kind":"plain","computed":true},"supports_signing":{"type":"bool","description":"Whether or not the key supports signing, based on key type.","description_kind":"plain","computed":true},"type":{"type":"string","description":"Specifies the type of key to create. The currently-supported types are: aes128-gcm96, aes256-gcm96, chacha20-poly1305, ed25519, ecdsa-p256, ecdsa-p384, ecdsa-p521, hmac, rsa-2048, rsa-3072, rsa-4096","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transit_secret_cache_config":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The Transit secret backend the resource belongs to.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"size":{"type":"number","description":"Number of cache entries. A size of 0 mean unlimited.","description_kind":"plain","required":true}},"description_kind":"plain"}}},"data_source_schemas":{"vault_ad_access_credentials":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"AD Secret Backend to read credentials from.","description_kind":"plain","required":true},"current_password":{"type":"string","description":"Password for the service account.","description_kind":"plain","computed":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"last_password":{"type":"string","description":"Last known password for the service account.","description_kind":"plain","computed":true,"sensitive":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"username":{"type":"string","description":"Name of the service account.","description_kind":"plain","computed":true}},"description_kind":"plain","deprecated":true}},"vault_approle_auth_backend_role_id":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_id":{"type":"string","description":"The RoleID of the role.","description_kind":"plain","computed":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_auth_backend":{"version":1,"block":{"attributes":{"accessor":{"type":"string","description":"The accessor of the auth backend.","description_kind":"plain","computed":true},"default_lease_ttl_seconds":{"type":"number","description":"Default lease duration in seconds","description_kind":"plain","computed":true},"description":{"type":"string","description":"The description of the auth backend.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"listing_visibility":{"type":"string","description":"Specifies whether to show this mount in the UI-specific listing endpoint.","description_kind":"plain","computed":true},"local":{"type":"bool","description":"Specifies if the auth method is local only","description_kind":"plain","computed":true},"max_lease_ttl_seconds":{"type":"number","description":"Maximum possible lease duration in seconds","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"The auth backend mount point.","description_kind":"plain","required":true},"type":{"type":"string","description":"The name of the auth backend.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_auth_backends":{"version":0,"block":{"attributes":{"accessors":{"type":["list","string"],"description":"The accessors of the auth backends.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"paths":{"type":["list","string"],"description":"The auth backend mount points.","description_kind":"plain","computed":true},"type":{"type":"string","description":"The type of the auth backend.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_access_credentials":{"version":0,"block":{"attributes":{"access_key":{"type":"string","description":"AWS access key ID read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"backend":{"type":"string","description":"AWS Secret Backend to read credentials from.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"Lease duration in seconds relative to the time in lease_start_time.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"Lease identifier assigned by vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"lease_start_time":{"type":"string","description":"Time at which the lease was read, using the clock of the system where Terraform was running","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"region":{"type":"string","description":"Region the read credentials belong to.","description_kind":"plain","optional":true},"role":{"type":"string","description":"AWS Secret Role to read credentials from.","description_kind":"plain","required":true},"role_arn":{"type":"string","description":"ARN to use if multiple are available in the role. Required if the role has multiple ARNs.","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"AWS secret key read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"security_token":{"type":"string","description":"AWS security token read from Vault. (Only returned if type is 'sts').","description_kind":"plain","computed":true,"sensitive":true},"ttl":{"type":"string","description":"User specified Time-To-Live for the STS token. Uses the Role defined default_sts_ttl when not specified","description_kind":"plain","optional":true},"type":{"type":"string","description":"Type of credentials to read. Must be either 'creds' for Access Key and Secret Key, or 'sts' for STS.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_aws_static_access_credentials":{"version":0,"block":{"attributes":{"access_key":{"type":"string","description":"AWS access key ID read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"backend":{"type":"string","description":"AWS Secret Backend to read credentials from.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"secret_key":{"type":"string","description":"AWS secret key read from Vault.","description_kind":"plain","computed":true,"sensitive":true}},"description_kind":"plain"}},"vault_azure_access_credentials":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Azure Secret Backend to read credentials from.","description_kind":"plain","required":true},"client_id":{"type":"string","description":"The client id for credentials to query the Azure APIs.","description_kind":"plain","computed":true},"client_secret":{"type":"string","description":"The client secret for credentials to query the Azure APIs.","description_kind":"plain","computed":true,"sensitive":true},"environment":{"type":"string","description":"The Azure environment to use during credential validation.\nDefaults to the environment configured in the Vault backend.\nSome possible values: AzurePublicCloud, AzureUSGovernmentCloud","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"Lease duration in seconds relative to the time in lease_start_time.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"Lease identifier assigned by vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"lease_start_time":{"type":"string","description":"Time at which the lease was read, using the clock of the system where Terraform was running","description_kind":"plain","computed":true},"max_cred_validation_seconds":{"type":"number","description":"If 'validate_creds' is true, the number of seconds after which to give up validating credentials.","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"num_seconds_between_tests":{"type":"number","description":"If 'validate_creds' is true, the number of seconds to wait between each test of generated credentials.","description_kind":"plain","optional":true},"num_sequential_successes":{"type":"number","description":"If 'validate_creds' is true, the number of sequential successes required to validate generated credentials.","description_kind":"plain","optional":true},"role":{"type":"string","description":"Azure Secret Role to read credentials from.","description_kind":"plain","required":true},"subscription_id":{"type":"string","description":"The subscription ID to use during credential validation. Defaults to the subscription ID configured in the Vault backend","description_kind":"plain","optional":true},"tenant_id":{"type":"string","description":"The tenant ID to use during credential validation. Defaults to the tenant ID configured in the Vault backend","description_kind":"plain","optional":true},"validate_creds":{"type":"bool","description":"Whether generated credentials should be validated before being returned.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_gcp_auth_backend_role":{"version":1,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the auth backend to configure.","description_kind":"plain","optional":true},"bound_instance_groups":{"type":["set","string"],"description_kind":"plain","computed":true},"bound_labels":{"type":["set","string"],"description_kind":"plain","computed":true},"bound_projects":{"type":["set","string"],"description_kind":"plain","computed":true},"bound_regions":{"type":["set","string"],"description_kind":"plain","computed":true},"bound_service_accounts":{"type":["set","string"],"description_kind":"plain","computed":true},"bound_zones":{"type":["set","string"],"description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_id":{"type":"string","description":"The RoleID of the GCP auth role.","description_kind":"plain","computed":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true},"type":{"type":"string","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_generic_secret":{"version":1,"block":{"attributes":{"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"Lease duration in seconds relative to the time in lease_start_time.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"Lease identifier assigned by vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"lease_start_time":{"type":"string","description":"Time at which the lease was read, using the clock of the system where Terraform was running","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path from which a secret will be read.","description_kind":"plain","required":true},"version":{"type":"number","description_kind":"plain","optional":true},"with_lease_start_time":{"type":"bool","description":"If set to true, stores 'lease_start_time' in the TF state.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_entity":{"version":0,"block":{"attributes":{"alias_id":{"type":"string","description":"ID of the alias.","description_kind":"plain","optional":true,"computed":true},"alias_mount_accessor":{"type":"string","description":"Accessor of the mount to which the alias belongs to. This should be supplied in conjunction with `alias_name`.","description_kind":"plain","optional":true,"computed":true},"alias_name":{"type":"string","description":"Name of the alias. This should be supplied in conjunction with `alias_mount_accessor`.","description_kind":"plain","optional":true,"computed":true},"aliases":{"type":["set",["object",{"canonical_id":"string","creation_time":"string","id":"string","last_update_time":"string","merged_from_canonical_ids":["set","string"],"metadata":["map","string"],"mount_accessor":"string","mount_path":"string","mount_type":"string","name":"string"}]],"description_kind":"plain","computed":true},"creation_time":{"type":"string","description_kind":"plain","computed":true},"data_json":{"type":"string","description":"Entity data from Vault in JSON String form","description_kind":"plain","computed":true},"direct_group_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"disabled":{"type":"bool","description_kind":"plain","computed":true},"entity_id":{"type":"string","description":"ID of the entity.","description_kind":"plain","optional":true,"computed":true},"entity_name":{"type":"string","description":"Name of the entity.","description_kind":"plain","optional":true,"computed":true},"group_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"inherited_group_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"last_update_time":{"type":"string","description_kind":"plain","computed":true},"merged_entity_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"metadata":{"type":["map","string"],"description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description_kind":"plain","computed":true},"policies":{"type":["set","string"],"description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_group":{"version":1,"block":{"attributes":{"alias_canonical_id":{"type":"string","description_kind":"plain","computed":true},"alias_creation_time":{"type":"string","description_kind":"plain","computed":true},"alias_id":{"type":"string","description":"ID of the alias.","description_kind":"plain","optional":true,"computed":true},"alias_last_update_time":{"type":"string","description_kind":"plain","computed":true},"alias_merged_from_canonical_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"alias_metadata":{"type":["map","string"],"description_kind":"plain","computed":true},"alias_mount_accessor":{"type":"string","description":"Accessor of the mount to which the alias belongs to. This should be supplied in conjunction with `alias_name`.","description_kind":"plain","optional":true,"computed":true},"alias_mount_path":{"type":"string","description_kind":"plain","computed":true},"alias_mount_type":{"type":"string","description_kind":"plain","computed":true},"alias_name":{"type":"string","description":"Name of the alias. This should be supplied in conjunction with `alias_mount_accessor`.","description_kind":"plain","optional":true,"computed":true},"creation_time":{"type":"string","description_kind":"plain","computed":true},"data_json":{"type":"string","description":"Group data from Vault in JSON String form","description_kind":"plain","computed":true},"group_id":{"type":"string","description":"ID of the group.","description_kind":"plain","optional":true,"computed":true},"group_name":{"type":"string","description":"Name of the group.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"last_update_time":{"type":"string","description_kind":"plain","computed":true},"member_entity_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"member_group_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"metadata":{"type":["map","string"],"description_kind":"plain","computed":true},"modify_index":{"type":"number","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"namespace_id":{"type":"string","description_kind":"plain","computed":true},"parent_group_ids":{"type":["set","string"],"description_kind":"plain","computed":true},"policies":{"type":["set","string"],"description_kind":"plain","computed":true},"type":{"type":"string","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_oidc_client_creds":{"version":0,"block":{"attributes":{"client_id":{"type":"string","description":"The Client ID from Vault.","description_kind":"plain","computed":true},"client_secret":{"type":"string","description":"The Client Secret from Vault.","description_kind":"plain","computed":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"name":{"type":"string","description":"The name of the client.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_identity_oidc_openid_config":{"version":0,"block":{"attributes":{"authorization_endpoint":{"type":"string","description":"The Authorization Endpoint for the provider.","description_kind":"plain","computed":true},"grant_types_supported":{"type":["list","string"],"description":"The grant types supported by the provider.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"id_token_signing_alg_values_supported":{"type":["list","string"],"description":"The signing algorithms supported by the provider.","description_kind":"plain","computed":true},"issuer":{"type":"string","description":"The URL of the issuer for the provider.","description_kind":"plain","computed":true},"jwks_uri":{"type":"string","description":"The well known keys URI for the provider.","description_kind":"plain","computed":true},"name":{"type":"string","description":"The name of the provider.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"request_uri_parameter_supported":{"type":"bool","description":"Specifies whether Request URI Parameter is supported by the provider.","description_kind":"plain","computed":true},"response_types_supported":{"type":["list","string"],"description":"The response types supported by the provider.","description_kind":"plain","computed":true},"scopes_supported":{"type":["list","string"],"description":"The scopes supported by the provider.","description_kind":"plain","computed":true},"subject_types_supported":{"type":["list","string"],"description":"The subject types supported by the provider.","description_kind":"plain","computed":true},"token_endpoint":{"type":"string","description":"The Token Endpoint for the provider.","description_kind":"plain","computed":true},"token_endpoint_auth_methods_supported":{"type":["list","string"],"description":"The token endpoint auth methods supported by the provider.","description_kind":"plain","computed":true},"userinfo_endpoint":{"type":"string","description":"The User Info Endpoint for the provider.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_identity_oidc_public_keys":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"keys":{"type":["list",["map","string"]],"description":"The public portion of keys for an OIDC provider. Clients can use them to validate the authenticity of an identity token.","description_kind":"plain","computed":true},"name":{"type":"string","description":"The name of the provider.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kubernetes_auth_backend_config":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Unique name of the kubernetes backend to configure.","description_kind":"plain","optional":true},"disable_iss_validation":{"type":"bool","description":"Optional disable JWT issuer validation. Allows to skip ISS validation.","description_kind":"plain","optional":true,"computed":true},"disable_local_ca_jwt":{"type":"bool","description":"Optional disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer":{"type":"string","description":"Optional JWT issuer. If no issuer is specified, kubernetes.io/serviceaccount will be used as the default issuer.","description_kind":"plain","optional":true,"computed":true},"kubernetes_ca_cert":{"type":"string","description":"PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.","description_kind":"plain","optional":true,"computed":true},"kubernetes_host":{"type":"string","description":"Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"pem_keys":{"type":["list","string"],"description":"Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys.","description_kind":"plain","optional":true,"computed":true}},"description_kind":"plain"}},"vault_kubernetes_auth_backend_role":{"version":0,"block":{"attributes":{"alias_name_source":{"type":"string","description":"Method used for generating identity aliases.","description_kind":"plain","computed":true},"audience":{"type":"string","description":"Optional Audience claim to verify in the JWT.","description_kind":"plain","optional":true},"backend":{"type":"string","description":"Unique name of the kubernetes backend to configure.","description_kind":"plain","optional":true},"bound_service_account_names":{"type":["set","string"],"description":"List of service account names able to access this role. If set to \"*\" all names are allowed, both this and bound_service_account_namespaces can not be \"*\".","description_kind":"plain","computed":true},"bound_service_account_namespaces":{"type":["set","string"],"description":"List of namespaces allowed to access this role. If set to \"*\" all namespaces are allowed, both this and bound_service_account_names can not be set to \"*\".","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"token_bound_cidrs":{"type":["set","string"],"description":"Specifies the blocks of IP addresses which are allowed to use the generated token","description_kind":"plain","optional":true},"token_explicit_max_ttl":{"type":"number","description":"Generated Token's Explicit Maximum TTL in seconds","description_kind":"plain","optional":true},"token_max_ttl":{"type":"number","description":"The maximum lifetime of the generated token","description_kind":"plain","optional":true},"token_no_default_policy":{"type":"bool","description":"If true, the 'default' policy will not automatically be added to generated tokens","description_kind":"plain","optional":true},"token_num_uses":{"type":"number","description":"The maximum number of times a token may be used, a value of zero means unlimited","description_kind":"plain","optional":true},"token_period":{"type":"number","description":"Generated Token's Period","description_kind":"plain","optional":true},"token_policies":{"type":["set","string"],"description":"Generated Token's Policies","description_kind":"plain","optional":true},"token_ttl":{"type":"number","description":"The initial ttl of the token to generate in seconds","description_kind":"plain","optional":true},"token_type":{"type":"string","description":"The type of token to generate, service or batch","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kubernetes_service_account_token":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The Kubernetes secret backend to generate service account tokens from.","description_kind":"plain","required":true},"cluster_role_binding":{"type":"bool","description":"If true, generate a ClusterRoleBinding to grant permissions across the whole cluster instead of within a namespace.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"kubernetes_namespace":{"type":"string","description":"The name of the Kubernetes namespace in which to generate the credentials.","description_kind":"plain","required":true},"lease_duration":{"type":"number","description":"The duration of the lease in seconds.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"The lease identifier assigned by Vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description":"The name of the role.","description_kind":"plain","required":true},"service_account_name":{"type":"string","description":"The name of the service account associated with the token.","description_kind":"plain","computed":true},"service_account_namespace":{"type":"string","description":"The Kubernetes namespace that the service account resides in.","description_kind":"plain","computed":true},"service_account_token":{"type":"string","description":"The Kubernetes service account token.","description_kind":"plain","computed":true,"sensitive":true},"ttl":{"type":"string","description":"The TTL of the generated Kubernetes service account token, specified in seconds or as a Go duration format string","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kv_secret":{"version":0,"block":{"attributes":{"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"Lease duration in seconds.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"Lease identifier assigned by Vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path of the KV-V1 secret.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_kv_secret_subkeys_v2":{"version":0,"block":{"attributes":{"data":{"type":["map","string"],"description":"Subkeys stored as a map of strings.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"Subkeys for the KV-V2 secret read from Vault.","description_kind":"plain","computed":true},"depth":{"type":"number","description":"Specifies the deepest nesting level to provide in the output.If non-zero, keys that reside at the specified depth value will be artificially treated as leaves and will thus be 'null' even if further underlying sub-keys exist.","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Path where KV-V2 engine is mounted","description_kind":"plain","required":true},"name":{"type":"string","description":"Full name of the secret. For a nested secret, the name is the nested path excluding the mount and data prefix. For example, for a secret at 'kvv2/data/foo/bar/baz', the name is 'foo/bar/baz'","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where the generic secret will be written.","description_kind":"plain","computed":true},"version":{"type":"number","description":"Specifies the version to return. If not set the latest version is returned.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kv_secret_v2":{"version":0,"block":{"attributes":{"created_time":{"type":"string","description":"Time at which the secret was created","description_kind":"plain","computed":true},"custom_metadata":{"type":["map","string"],"description":"Custom metadata for the secret","description_kind":"plain","computed":true},"data":{"type":["map","string"],"description":"Map of strings read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"data_json":{"type":"string","description":"JSON-encoded secret data read from Vault.","description_kind":"plain","computed":true,"sensitive":true},"deletion_time":{"type":"string","description":"Deletion time for the secret","description_kind":"plain","computed":true},"destroyed":{"type":"bool","description":"Indicates whether the secret has been destroyed","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Path where KV-V2 engine is mounted","description_kind":"plain","required":true},"name":{"type":"string","description":"Full name of the secret. For a nested secret, the name is the nested path excluding the mount and data prefix. For example, for a secret at 'kvv2/data/foo/bar/baz', the name is 'foo/bar/baz'","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where the KVV2 secret is written.","description_kind":"plain","computed":true},"version":{"type":"number","description":"Version of the secret to retrieve","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_kv_secrets_list":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"names":{"type":["list","string"],"description":"List of all secret names.","description_kind":"plain","computed":true,"sensitive":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full KV-V1 path where secrets will be listed.","description_kind":"plain","required":true}},"description_kind":"plain"}},"vault_kv_secrets_list_v2":{"version":0,"block":{"attributes":{"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"mount":{"type":"string","description":"Path where KV-V2 engine is mounted","description_kind":"plain","required":true},"name":{"type":"string","description":"Full named path of the secret. For a nested secret, the name is the nested path excluding the mount and data prefix. For example, for a secret at 'kvv2/data/foo/bar/baz', the name is 'foo/bar/baz'","description_kind":"plain","optional":true},"names":{"type":["list","string"],"description":"List of all secret names.","description_kind":"plain","computed":true,"sensitive":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Full path where the KV-V2 secrets are listed.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_ldap_dynamic_credentials":{"version":0,"block":{"attributes":{"distinguished_names":{"type":["list","string"],"description":"List of the distinguished names (DN) created.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"lease_duration":{"type":"number","description":"Lease duration in seconds.","description_kind":"plain","computed":true},"lease_id":{"type":"string","description":"Lease identifier assigned by Vault.","description_kind":"plain","computed":true},"lease_renewable":{"type":"bool","description":"True if the duration of this lease can be extended through renewal.","description_kind":"plain","computed":true},"mount":{"type":"string","description":"LDAP Secret Backend to read credentials from.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"password":{"type":"string","description":"Password for the dynamic role.","description_kind":"plain","computed":true,"sensitive":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"username":{"type":"string","description":"Name of the dynamic role.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_ldap_static_credentials":{"version":0,"block":{"attributes":{"dn":{"type":"string","description":"Distinguished name (DN) of the existing LDAP entry to manage password rotation for.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"last_password":{"type":"string","description":"Last known password for the static role.","description_kind":"plain","computed":true,"sensitive":true},"last_vault_rotation":{"type":"string","description":"Last time Vault rotated this static role's password.","description_kind":"plain","computed":true},"mount":{"type":"string","description":"LDAP Secret Backend to read credentials from.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"password":{"type":"string","description":"Password for the static role.","description_kind":"plain","computed":true,"sensitive":true},"role_name":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"rotation_period":{"type":"number","description":"How often Vault should rotate the password of the user entry.","description_kind":"plain","computed":true},"ttl":{"type":"number","description":"Duration in seconds after which the issued credential should expire.","description_kind":"plain","computed":true},"username":{"type":"string","description":"Name of the static role.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_nomad_access_token":{"version":0,"block":{"attributes":{"accessor_id":{"type":"string","description":"The public identifier for a specific token. It can be used to look up information about a token or to revoke a token.","description_kind":"plain","computed":true},"backend":{"type":"string","description":"Nomad secret backend to generate tokens from.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"role":{"type":"string","description":"Name of the role.","description_kind":"plain","required":true},"secret_id":{"type":"string","description":"Used to make requests to Nomad and should be kept private.","description_kind":"plain","computed":true,"sensitive":true}},"description_kind":"plain"}},"vault_pki_secret_backend_issuer":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"ca_chain":{"type":["list","string"],"description":"The CA chain as a list of format specific certificates","description_kind":"plain","computed":true},"certificate":{"type":"string","description":"The certificate.","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"issuer_id":{"type":"string","description":"ID of the issuer.","description_kind":"plain","computed":true},"issuer_name":{"type":"string","description":"Name of the issuer.","description_kind":"plain","computed":true},"issuer_ref":{"type":"string","description":"Reference to an existing issuer.","description_kind":"plain","required":true},"key_id":{"type":"string","description":"ID of the key used by the issuer.","description_kind":"plain","computed":true},"leaf_not_after_behavior":{"type":"string","description":"Behavior of a leaf's NotAfter field during issuance.","description_kind":"plain","computed":true},"manual_chain":{"type":["list","string"],"description":"Chain of issuer references to build this issuer's computed CAChain field from, when non-empty","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"usage":{"type":"string","description":"Allowed usages for this issuer.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_pki_secret_backend_issuers":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_info":{"type":["map","string"],"description":"Map of issuer strings read from Vault.","description_kind":"plain","computed":true},"key_info_json":{"type":"string","description":"JSON-encoded key info data read from Vault.","description_kind":"plain","computed":true},"keys":{"type":["list","string"],"description":"Keys used by issuers under the backend path.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_key":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_id":{"type":"string","description":"ID of the key used.","description_kind":"plain","computed":true},"key_name":{"type":"string","description":"Name of the key.","description_kind":"plain","computed":true},"key_ref":{"type":"string","description":"Reference to an existing key.","description_kind":"plain","required":true},"key_type":{"type":"string","description":"Type of the key.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_pki_secret_backend_keys":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"Full path where PKI backend is mounted.","description_kind":"plain","required":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key_info":{"type":["map","string"],"description":"Map of key strings read from Vault.","description_kind":"plain","computed":true},"key_info_json":{"type":"string","description":"JSON-encoded key data read from Vault.","description_kind":"plain","computed":true},"keys":{"type":["list","string"],"description":"Keys used under the backend path.","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_policy_document":{"version":0,"block":{"attributes":{"hcl":{"type":"string","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true}},"block_types":{"rule":{"nesting_mode":"list","block":{"attributes":{"capabilities":{"type":["list","string"],"description_kind":"plain","required":true},"description":{"type":"string","description_kind":"plain","optional":true},"max_wrapping_ttl":{"type":"string","description_kind":"plain","optional":true},"min_wrapping_ttl":{"type":"string","description_kind":"plain","optional":true},"path":{"type":"string","description_kind":"plain","required":true},"required_parameters":{"type":["list","string"],"description_kind":"plain","optional":true}},"block_types":{"allowed_parameter":{"nesting_mode":"list","block":{"attributes":{"key":{"type":"string","description_kind":"plain","required":true},"value":{"type":["list","string"],"description_kind":"plain","required":true}},"description_kind":"plain"}},"denied_parameter":{"nesting_mode":"list","block":{"attributes":{"key":{"type":"string","description_kind":"plain","required":true},"value":{"type":["list","string"],"description_kind":"plain","required":true}},"description_kind":"plain"}}},"description":"The policy rule","description_kind":"plain"}}},"description_kind":"plain"}},"vault_raft_autopilot_state":{"version":0,"block":{"attributes":{"failure_tolerance":{"type":"number","description":"How many nodes could fail before the cluster becomes unhealthy","description_kind":"plain","computed":true},"healthy":{"type":"bool","description":"Health status","description_kind":"plain","computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"leader":{"type":"string","description":"Current leader of Vault","description_kind":"plain","computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"optimistic_failure_tolerance":{"type":"number","description":"The cluster-level optimistic failure tolerance.","description_kind":"plain","computed":true},"redundancy_zones":{"type":["map","string"],"description":"Additional output related to redundancy zones stored as a map of strings.","description_kind":"plain","computed":true},"redundancy_zones_json":{"type":"string","description":"Subkeys for the redundancy zones read from Vault.","description_kind":"plain","computed":true},"servers":{"type":["map","string"],"description":"Additional output related to servers stored as a map of strings.","description_kind":"plain","computed":true},"servers_json":{"type":"string","description":"Subkeys for the servers read from Vault.","description_kind":"plain","computed":true},"upgrade_info":{"type":["map","string"],"description":"Additional output related to upgrade info stored as a map of strings.","description_kind":"plain","computed":true},"upgrade_info_json":{"type":"string","description":"Subkeys for the servers read from Vault.","description_kind":"plain","computed":true},"voters":{"type":["list","string"],"description":"The voters in the Vault cluster.","description_kind":"plain","computed":true}},"description_kind":"plain"}},"vault_transform_decode":{"version":0,"block":{"attributes":{"batch_input":{"type":["list",["map","string"]],"description":"Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.","description_kind":"plain","optional":true},"batch_results":{"type":["list",["map","string"]],"description":"The result of decoding batch_input.","description_kind":"plain","optional":true,"computed":true},"decoded_value":{"type":"string","description":"The result of decoding a value.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to backend from which to retrieve data.","description_kind":"plain","required":true},"role_name":{"type":"string","description":"The name of the role.","description_kind":"plain","required":true},"transformation":{"type":"string","description":"The transformation to perform. If no value is provided and the role contains a single transformation, this value will be inferred from the role.","description_kind":"plain","optional":true},"tweak":{"type":"string","description":"The tweak value to use. Only applicable for FPE transformations","description_kind":"plain","optional":true},"value":{"type":"string","description":"The value in which to decode.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transform_encode":{"version":0,"block":{"attributes":{"batch_input":{"type":["list",["map","string"]],"description":"Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.","description_kind":"plain","optional":true},"batch_results":{"type":["list",["map","string"]],"description":"The result of encoding batch_input.","description_kind":"plain","optional":true,"computed":true},"encoded_value":{"type":"string","description":"The result of encoding a value.","description_kind":"plain","optional":true,"computed":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"path":{"type":"string","description":"Path to backend from which to retrieve data.","description_kind":"plain","required":true},"role_name":{"type":"string","description":"The name of the role.","description_kind":"plain","required":true},"transformation":{"type":"string","description":"The transformation to perform. If no value is provided and the role contains a single transformation, this value will be inferred from the role.","description_kind":"plain","optional":true},"tweak":{"type":"string","description":"The tweak value to use. Only applicable for FPE transformations","description_kind":"plain","optional":true},"value":{"type":"string","description":"The value in which to encode.","description_kind":"plain","optional":true}},"description_kind":"plain"}},"vault_transit_decrypt":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The Transit secret backend the key belongs to.","description_kind":"plain","required":true},"ciphertext":{"type":"string","description":"Transit encrypted cipher text.","description_kind":"plain","required":true},"context":{"type":"string","description":"Specifies the context for key derivation","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key":{"type":"string","description":"Name of the decryption key to use.","description_kind":"plain","required":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"plaintext":{"type":"string","description":"Decrypted plain text","description_kind":"plain","computed":true,"sensitive":true}},"description_kind":"plain"}},"vault_transit_encrypt":{"version":0,"block":{"attributes":{"backend":{"type":"string","description":"The Transit secret backend the key belongs to.","description_kind":"plain","required":true},"ciphertext":{"type":"string","description":"Transit encrypted cipher text.","description_kind":"plain","computed":true},"context":{"type":"string","description":"Specifies the context for key derivation","description_kind":"plain","optional":true},"id":{"type":"string","description_kind":"plain","optional":true,"computed":true},"key":{"type":"string","description":"Name of the encryption key to use.","description_kind":"plain","required":true},"key_version":{"type":"number","description":"The version of the key to use for encryption","description_kind":"plain","optional":true},"namespace":{"type":"string","description":"Target namespace. (requires Enterprise)","description_kind":"plain","optional":true},"plaintext":{"type":"string","description":"Map of strings read from Vault.","description_kind":"plain","required":true,"sensitive":true}},"description_kind":"plain"}}}}}} diff --git a/examples-generated/mongodbatlas/secretbackend.yaml b/examples-generated/mongodbatlas/secretbackend.yaml index 71b9698e..41e0b4cc 100644 --- a/examples-generated/mongodbatlas/secretbackend.yaml +++ b/examples-generated/mongodbatlas/secretbackend.yaml @@ -8,7 +8,7 @@ metadata: name: config spec: forProvider: - mount: dummy + mount: vault_mount.mongo.path privateKey: privateKey publicKey: publicKey diff --git a/examples-generated/mongodbatlas/secretrole.yaml b/examples-generated/mongodbatlas/secretrole.yaml index 2d544efc..e9cf0b86 100644 --- a/examples-generated/mongodbatlas/secretrole.yaml +++ b/examples-generated/mongodbatlas/secretrole.yaml @@ -15,10 +15,8 @@ spec: name: tf-test-role organizationId: 7cf5a45a9ccf6400e60981b7 projectId: 5cf5a45a9ccf6400e60981b6 - projectRoles: - - GROUP_READ_ONLY - roles: - - ORG_READ_ONLY + projectRoles: GROUP_READ_ONLY + roles: ORG_READ_ONLY ttl: "60" --- @@ -33,7 +31,7 @@ metadata: name: config spec: forProvider: - mount: '%s' + mount: vault_mount.mongo.path privateKey: privateKey publicKey: publicKey diff --git a/examples/providerconfig/providerconfig.yaml b/examples/providerconfig/providerconfig.yaml index 0172d9db..e4a7b978 100644 --- a/examples/providerconfig/providerconfig.yaml +++ b/examples/providerconfig/providerconfig.yaml @@ -1,12 +1,13 @@ apiVersion: vault.upbound.io/v1beta1 kind: ProviderConfig metadata: - name: vault-provider-config + name: default spec: - address: http://127.0.0.1:8200 + namespace: cx_industry/infra-as-data + address: http://vault.tools.sap credentials: source: Secret secretRef: name: vault-creds - namespace: vault + namespace: crossplane-system key: credentials diff --git a/examples/providerconfig/secret.yaml.tmpl b/examples/providerconfig/secret.yaml.tmpl index 5cd6dae5..992cc5a4 100644 --- a/examples/providerconfig/secret.yaml.tmpl +++ b/examples/providerconfig/secret.yaml.tmpl @@ -2,22 +2,16 @@ apiVersion: v1 kind: Secret metadata: name: vault-creds - namespace: vault + namespace: crossplane-system type: Opaque stringData: - # WARNING: DO NOT CHECK REAL TOKENS INTO GIT credentials: | { - "token_name": "vault-creds-test-token", - "token": "INSERT_VAULT_OPERATOR_INIT_OR_DERIVED_TOKEN" + "auth_login": { + "path": "auth/approle-mmp-onboarding/login", + "parameters": { + "role_id": "80fccabf-5108-816a-ba4e-26d1f2434574", + "secret_id": "823b19d3-4364-b2a3-0cf1-74a2e1f00abf" + } + } } - # Approle login example - #{ - # "auth_login": { - # "path": "auth/approle/login", - # "parameters": { - # "role_id": "" - # "secret_id": "" - # } - # } - #} diff --git a/package/crds/ad.vault.upbound.io_secretbackends.yaml b/package/crds/ad.vault.upbound.io_secretbackends.yaml index 05429117..1268ea9c 100644 --- a/package/crds/ad.vault.upbound.io_secretbackends.yaml +++ b/package/crds/ad.vault.upbound.io_secretbackends.yaml @@ -178,6 +178,11 @@ spec: Name of a user. Use anonymous bind to discover the bind DN of a user. type: boolean + formatter: + description: Deprecated use password_policy. Text to insert the + password into, ex. "customPrefix{{PASSWORD}}customSuffix". Text + to insert the password into, ex. "customPrefix{{PASSWORD}}customSuffix". + type: string groupattr: description: 'LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: cn or memberOf, @@ -212,6 +217,11 @@ spec: if Active Directory shows a later rotation, it should be considered out-of-band. type: number + length: + description: Deprecated use password_policy. The desired length + of passwords that Vault generates. Mutually exclusive with The + desired length of passwords that Vault generates. + type: number local: description: Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration @@ -236,8 +246,8 @@ spec: Enterprise) type: string passwordPolicy: - description: Name of the password policy to use to generate passwords. - Name of the password policy to use to generate passwords. + description: 1.11+ Name of the password policy to use to generate + passwords. type: string requestTimeout: description: Timeout, in seconds, for the connection when making @@ -379,6 +389,11 @@ spec: Name of a user. Use anonymous bind to discover the bind DN of a user. type: boolean + formatter: + description: Deprecated use password_policy. Text to insert the + password into, ex. "customPrefix{{PASSWORD}}customSuffix". Text + to insert the password into, ex. "customPrefix{{PASSWORD}}customSuffix". + type: string groupattr: description: 'LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: cn or memberOf, @@ -413,6 +428,11 @@ spec: if Active Directory shows a later rotation, it should be considered out-of-band. type: number + length: + description: Deprecated use password_policy. The desired length + of passwords that Vault generates. Mutually exclusive with The + desired length of passwords that Vault generates. + type: number local: description: Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration @@ -437,8 +457,8 @@ spec: Enterprise) type: string passwordPolicy: - description: Name of the password policy to use to generate passwords. - Name of the password policy to use to generate passwords. + description: 1.11+ Name of the password policy to use to generate + passwords. type: string requestTimeout: description: Timeout, in seconds, for the connection when making @@ -777,6 +797,11 @@ spec: Name of a user. Use anonymous bind to discover the bind DN of a user. type: boolean + formatter: + description: Deprecated use password_policy. Text to insert the + password into, ex. "customPrefix{{PASSWORD}}customSuffix". Text + to insert the password into, ex. "customPrefix{{PASSWORD}}customSuffix". + type: string groupattr: description: 'LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: cn or memberOf, @@ -813,6 +838,11 @@ spec: if Active Directory shows a later rotation, it should be considered out-of-band. type: number + length: + description: Deprecated use password_policy. The desired length + of passwords that Vault generates. Mutually exclusive with The + desired length of passwords that Vault generates. + type: number local: description: Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration @@ -837,8 +867,8 @@ spec: Enterprise) type: string passwordPolicy: - description: Name of the password policy to use to generate passwords. - Name of the password policy to use to generate passwords. + description: 1.11+ Name of the password policy to use to generate + passwords. type: string requestTimeout: description: Timeout, in seconds, for the connection when making diff --git a/package/crds/cert.vault.upbound.io_authbackendroles.yaml b/package/crds/cert.vault.upbound.io_authbackendroles.yaml index f4e31370..90933629 100644 --- a/package/crds/cert.vault.upbound.io_authbackendroles.yaml +++ b/package/crds/cert.vault.upbound.io_authbackendroles.yaml @@ -83,6 +83,10 @@ spec: items: type: string type: array + allowedOrganizationUnits: + items: + type: string + type: array allowedOrganizationalUnits: items: type: string @@ -195,6 +199,10 @@ spec: items: type: string type: array + allowedOrganizationUnits: + items: + type: string + type: array allowedOrganizationalUnits: items: type: string @@ -505,6 +513,10 @@ spec: items: type: string type: array + allowedOrganizationUnits: + items: + type: string + type: array allowedOrganizationalUnits: items: type: string diff --git a/package/crds/consul.vault.upbound.io_secretbackendroles.yaml b/package/crds/consul.vault.upbound.io_secretbackendroles.yaml index 8a76dd14..c0495c66 100644 --- a/package/crds/consul.vault.upbound.io_secretbackendroles.yaml +++ b/package/crds/consul.vault.upbound.io_secretbackendroles.yaml @@ -148,6 +148,13 @@ spec: items: type: string type: array + tokenType: + description: 'Specifies the type of token to create when using + this role. Valid values are "client" or "management". Deprecated: + Consul 1.11 and later removed the legacy ACL system which supported + this field. Specifies the type of token to create when using + this role. Valid values are "client" or "management".' + type: string ttl: description: Specifies the TTL for this role. Specifies the TTL for this role. @@ -247,6 +254,13 @@ spec: items: type: string type: array + tokenType: + description: 'Specifies the type of token to create when using + this role. Valid values are "client" or "management". Deprecated: + Consul 1.11 and later removed the legacy ACL system which supported + this field. Specifies the type of token to create when using + this role. Valid values are "client" or "management".' + type: string ttl: description: Specifies the TTL for this role. Specifies the TTL for this role. @@ -542,6 +556,13 @@ spec: items: type: string type: array + tokenType: + description: 'Specifies the type of token to create when using + this role. Valid values are "client" or "management". Deprecated: + Consul 1.11 and later removed the legacy ACL system which supported + this field. Specifies the type of token to create when using + this role. Valid values are "client" or "management".' + type: string ttl: description: Specifies the TTL for this role. Specifies the TTL for this role. diff --git a/package/crds/identity.vault.upbound.io_groupmemberentityidsidses.yaml b/package/crds/identity.vault.upbound.io_groupmemberentityidsidses.yaml index 0cc3d78f..7803181e 100644 --- a/package/crds/identity.vault.upbound.io_groupmemberentityidsidses.yaml +++ b/package/crds/identity.vault.upbound.io_groupmemberentityidsidses.yaml @@ -343,6 +343,12 @@ spec: description: Group ID to assign member entities to. ID of the group. type: string + groupName: + description: 'The name of the group that are assigned the member + entities. Deprecated: The value for group_name may not always + be accurate use data.vault_identity_group.*.group_name, or vault_identity_group.*.group_name + instead. Name of the group.' + type: string id: type: string memberEntityIds: diff --git a/package/crds/identity.vault.upbound.io_oidcclients.yaml b/package/crds/identity.vault.upbound.io_oidcclients.yaml index b2830da7..c51d1003 100644 --- a/package/crds/identity.vault.upbound.io_oidcclients.yaml +++ b/package/crds/identity.vault.upbound.io_oidcclients.yaml @@ -396,8 +396,7 @@ spec: type: string type: array clientId: - description: The Client ID returned by Vault. The Client ID from - Vault. + description: The Client ID from Vault. type: string clientType: description: 'The client type based on its ability to maintain diff --git a/package/crds/kubernetes.vault.upbound.io_secretbackendroles.yaml b/package/crds/kubernetes.vault.upbound.io_secretbackendroles.yaml index 626cf9b5..51e1605a 100644 --- a/package/crds/kubernetes.vault.upbound.io_secretbackendroles.yaml +++ b/package/crds/kubernetes.vault.upbound.io_secretbackendroles.yaml @@ -67,24 +67,11 @@ spec: type: string forProvider: properties: - allowedKubernetesNamespaceSelector: - description: A label selector for Kubernetes namespaces in which - credentials can be generated. Accepts either a JSON or YAML - object. The value should be of type LabelSelector. If set with - allowed_kubernetes_namespace, the conditions are ORed. A label - selector for Kubernetes namespaces in which credentials can - begenerated. Accepts either a JSON or YAML object. The value - should be of typeLabelSelector. If set with `allowed_kubernetes_namespace`, - the conditions are `OR`ed. - type: string allowedKubernetesNamespaces: description: The list of Kubernetes namespaces this role can generate - credentials for. If set to * all namespaces are allowed. If - set with allowed_kubernetes_namespace_selector, the conditions - are ORed. The list of Kubernetes namespaces this role can generate - credentials for. If set to '*' all namespaces are allowed. If - set with`allowed_kubernetes_namespace_selector`, the conditions - are `OR`ed. + credentials for. If set to * all namespaces are allowed. The + list of Kubernetes namespaces this role can generate credentials + for. If set to '*' all namespaces are allowed. items: type: string type: array @@ -183,24 +170,11 @@ spec: creation, for example because of an external controller is managing them, like an autoscaler. properties: - allowedKubernetesNamespaceSelector: - description: A label selector for Kubernetes namespaces in which - credentials can be generated. Accepts either a JSON or YAML - object. The value should be of type LabelSelector. If set with - allowed_kubernetes_namespace, the conditions are ORed. A label - selector for Kubernetes namespaces in which credentials can - begenerated. Accepts either a JSON or YAML object. The value - should be of typeLabelSelector. If set with `allowed_kubernetes_namespace`, - the conditions are `OR`ed. - type: string allowedKubernetesNamespaces: description: The list of Kubernetes namespaces this role can generate - credentials for. If set to * all namespaces are allowed. If - set with allowed_kubernetes_namespace_selector, the conditions - are ORed. The list of Kubernetes namespaces this role can generate - credentials for. If set to '*' all namespaces are allowed. If - set with`allowed_kubernetes_namespace_selector`, the conditions - are `OR`ed. + credentials for. If set to * all namespaces are allowed. The + list of Kubernetes namespaces this role can generate credentials + for. If set to '*' all namespaces are allowed. items: type: string type: array @@ -484,6 +458,10 @@ spec: - forProvider type: object x-kubernetes-validations: + - message: allowedKubernetesNamespaces is a required parameter + rule: '!(''*'' in self.managementPolicies || ''Create'' in self.managementPolicies + || ''Update'' in self.managementPolicies) || has(self.forProvider.allowedKubernetesNamespaces) + || has(self.initProvider.allowedKubernetesNamespaces)' - message: backend is a required parameter rule: '!(''*'' in self.managementPolicies || ''Create'' in self.managementPolicies || ''Update'' in self.managementPolicies) || has(self.forProvider.backend) @@ -497,24 +475,11 @@ spec: properties: atProvider: properties: - allowedKubernetesNamespaceSelector: - description: A label selector for Kubernetes namespaces in which - credentials can be generated. Accepts either a JSON or YAML - object. The value should be of type LabelSelector. If set with - allowed_kubernetes_namespace, the conditions are ORed. A label - selector for Kubernetes namespaces in which credentials can - begenerated. Accepts either a JSON or YAML object. The value - should be of typeLabelSelector. If set with `allowed_kubernetes_namespace`, - the conditions are `OR`ed. - type: string allowedKubernetesNamespaces: description: The list of Kubernetes namespaces this role can generate - credentials for. If set to * all namespaces are allowed. If - set with allowed_kubernetes_namespace_selector, the conditions - are ORed. The list of Kubernetes namespaces this role can generate - credentials for. If set to '*' all namespaces are allowed. If - set with`allowed_kubernetes_namespace_selector`, the conditions - are `OR`ed. + credentials for. If set to * all namespaces are allowed. The + list of Kubernetes namespaces this role can generate credentials + for. If set to '*' all namespaces are allowed. items: type: string type: array diff --git a/package/crds/mongodbatlas.vault.upbound.io_secretroles.yaml b/package/crds/mongodbatlas.vault.upbound.io_secretroles.yaml index 1d970d69..38711200 100644 --- a/package/crds/mongodbatlas.vault.upbound.io_secretroles.yaml +++ b/package/crds/mongodbatlas.vault.upbound.io_secretroles.yaml @@ -111,17 +111,14 @@ spec: type: string projectRoles: description: Roles assigned when an org API key is assigned to - a project API key. Possible values are GROUP_CLUSTER_MANAGER, - GROUP_DATA_ACCESS_ADMIN, GROUP_DATA_ACCESS_READ_ONLY, GROUP_DATA_ACCESS_READ_WRITE, - GROUP_OWNER and GROUP_READ_ONLY. Roles assigned when an org - API key is assigned to a project API key + a project API key. Roles assigned when an org API key is assigned + to a project API key items: type: string type: array roles: - description: List of roles that the API Key needs to have. Possible - values are ORG_OWNER, ORG_MEMBER, ORG_GROUP_CREATOR, ORG_BILLING_ADMIN - and ORG_READ_ONLY. List of roles that the API Key needs to have + description: List of roles that the API Key needs to have. List + of roles that the API Key needs to have items: type: string type: array @@ -188,17 +185,14 @@ spec: type: string projectRoles: description: Roles assigned when an org API key is assigned to - a project API key. Possible values are GROUP_CLUSTER_MANAGER, - GROUP_DATA_ACCESS_ADMIN, GROUP_DATA_ACCESS_READ_ONLY, GROUP_DATA_ACCESS_READ_WRITE, - GROUP_OWNER and GROUP_READ_ONLY. Roles assigned when an org - API key is assigned to a project API key + a project API key. Roles assigned when an org API key is assigned + to a project API key items: type: string type: array roles: - description: List of roles that the API Key needs to have. Possible - values are ORG_OWNER, ORG_MEMBER, ORG_GROUP_CREATOR, ORG_BILLING_ADMIN - and ORG_READ_ONLY. List of roles that the API Key needs to have + description: List of roles that the API Key needs to have. List + of roles that the API Key needs to have items: type: string type: array @@ -469,17 +463,14 @@ spec: type: string projectRoles: description: Roles assigned when an org API key is assigned to - a project API key. Possible values are GROUP_CLUSTER_MANAGER, - GROUP_DATA_ACCESS_ADMIN, GROUP_DATA_ACCESS_READ_ONLY, GROUP_DATA_ACCESS_READ_WRITE, - GROUP_OWNER and GROUP_READ_ONLY. Roles assigned when an org - API key is assigned to a project API key + a project API key. Roles assigned when an org API key is assigned + to a project API key items: type: string type: array roles: - description: List of roles that the API Key needs to have. Possible - values are ORG_OWNER, ORG_MEMBER, ORG_GROUP_CREATOR, ORG_BILLING_ADMIN - and ORG_READ_ONLY. List of roles that the API Key needs to have + description: List of roles that the API Key needs to have. List + of roles that the API Key needs to have items: type: string type: array diff --git a/package/crds/pki.vault.upbound.io_secretbackendconfigurls.yaml b/package/crds/pki.vault.upbound.io_secretbackendconfigurls.yaml index 37d98aab..a910d047 100644 --- a/package/crds/pki.vault.upbound.io_secretbackendconfigurls.yaml +++ b/package/crds/pki.vault.upbound.io_secretbackendconfigurls.yaml @@ -80,10 +80,6 @@ spec: items: type: string type: array - enableTemplating: - description: Specifies that templating of AIA fields is allowed. - Specifies that templating of AIA fields is allowed. - type: boolean issuingCertificates: description: Specifies the URL values for the Issuing Certificate field. Specifies the URL values for the Issuing Certificate @@ -130,10 +126,6 @@ spec: items: type: string type: array - enableTemplating: - description: Specifies that templating of AIA fields is allowed. - Specifies that templating of AIA fields is allowed. - type: boolean issuingCertificates: description: Specifies the URL values for the Issuing Certificate field. Specifies the URL values for the Issuing Certificate @@ -375,10 +367,6 @@ spec: items: type: string type: array - enableTemplating: - description: Specifies that templating of AIA fields is allowed. - Specifies that templating of AIA fields is allowed. - type: boolean id: type: string issuingCertificates: diff --git a/package/crds/pki.vault.upbound.io_secretbackendrootcerts.yaml b/package/crds/pki.vault.upbound.io_secretbackendrootcerts.yaml index 36397c6d..2782170f 100644 --- a/package/crds/pki.vault.upbound.io_secretbackendrootcerts.yaml +++ b/package/crds/pki.vault.upbound.io_secretbackendrootcerts.yaml @@ -661,6 +661,10 @@ spec: province: description: The province The province. type: string + serial: + description: Deprecated, use serial_number instead. The serial + number. + type: string serialNumber: description: The certificate's serial number, hex formatted. The certificate's serial number, hex formatted. diff --git a/package/crds/pki.vault.upbound.io_secretbackendrootsignintermediates.yaml b/package/crds/pki.vault.upbound.io_secretbackendrootsignintermediates.yaml index da60165f..7c6ca8a4 100644 --- a/package/crds/pki.vault.upbound.io_secretbackendrootsignintermediates.yaml +++ b/package/crds/pki.vault.upbound.io_secretbackendrootsignintermediates.yaml @@ -547,6 +547,9 @@ spec: revoke: description: Revoke the certificate upon resource destruction. type: boolean + serial: + description: The serial number. + type: string serialNumber: description: The certificate's serial number, hex formatted. type: string diff --git a/package/crds/pki.vault.upbound.io_secretbackendsigns.yaml b/package/crds/pki.vault.upbound.io_secretbackendsigns.yaml index 10aff78f..60fe6a69 100644 --- a/package/crds/pki.vault.upbound.io_secretbackendsigns.yaml +++ b/package/crds/pki.vault.upbound.io_secretbackendsigns.yaml @@ -531,6 +531,9 @@ spec: Initially false, and then set to true during refresh once the expiration is less than min_seconds_remaining in the future. type: boolean + serial: + description: Use serial_number instead. The serial number. + type: string serialNumber: description: The certificate's serial number, hex formatted. The certificate's serial number, hex formatted. diff --git a/package/crds/ssh.vault.upbound.io_secretbackendroles.yaml b/package/crds/ssh.vault.upbound.io_secretbackendroles.yaml index f559641f..2391d922 100644 --- a/package/crds/ssh.vault.upbound.io_secretbackendroles.yaml +++ b/package/crds/ssh.vault.upbound.io_secretbackendroles.yaml @@ -134,6 +134,13 @@ spec: type: string type: object type: array + allowedUserKeyLengths: + additionalProperties: + type: number + description: 'Specifies a map of ssh key types and their expected + sizes which are allowed to be signed by the CA type. Deprecated: + use allowed_user_key_config instead' + type: object allowedUsers: description: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed. @@ -281,6 +288,13 @@ spec: type: string type: object type: array + allowedUserKeyLengths: + additionalProperties: + type: number + description: 'Specifies a map of ssh key types and their expected + sizes which are allowed to be signed by the CA type. Deprecated: + use allowed_user_key_config instead' + type: object allowedUsers: description: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed. @@ -630,6 +644,13 @@ spec: type: string type: object type: array + allowedUserKeyLengths: + additionalProperties: + type: number + description: 'Specifies a map of ssh key types and their expected + sizes which are allowed to be signed by the CA type. Deprecated: + use allowed_user_key_config instead' + type: object allowedUsers: description: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed. diff --git a/package/crds/transit.vault.upbound.io_secretbackendkeys.yaml b/package/crds/transit.vault.upbound.io_secretbackendkeys.yaml index 884e0a6a..5f1c7a61 100644 --- a/package/crds/transit.vault.upbound.io_secretbackendkeys.yaml +++ b/package/crds/transit.vault.upbound.io_secretbackendkeys.yaml @@ -73,6 +73,11 @@ spec: backup of named key in the plaintext format. Once set, this cannot be disabled. type: boolean + autoRotateInterval: + description: Replaced by auto_rotate_period. Amount of time the + key should live before being automatically rotated. A value + of 0 disables automatic rotation for the key. + type: number autoRotatePeriod: description: Amount of seconds the key should live before being automatically rotated. A value of 0 disables automatic rotation @@ -166,6 +171,11 @@ spec: backup of named key in the plaintext format. Once set, this cannot be disabled. type: boolean + autoRotateInterval: + description: Replaced by auto_rotate_period. Amount of time the + key should live before being automatically rotated. A value + of 0 disables automatic rotation for the key. + type: number autoRotatePeriod: description: Amount of seconds the key should live before being automatically rotated. A value of 0 disables automatic rotation @@ -457,6 +467,11 @@ spec: backup of named key in the plaintext format. Once set, this cannot be disabled. type: boolean + autoRotateInterval: + description: Replaced by auto_rotate_period. Amount of time the + key should live before being automatically rotated. A value + of 0 disables automatic rotation for the key. + type: number autoRotatePeriod: description: Amount of seconds the key should live before being automatically rotated. A value of 0 disables automatic rotation