Azure Native v2.63.0, Sep 24 24

This is the latest version of Azure Native. Use the Azure Native v1 docs if using the v1 version of this package.

Azure Native v2.63.0 published on Tuesday, Sep 24, 2024 by Pulumi

pulumi/pulumi-azure-native

azure-native.keyvault.Vault

Explore with Pulumi AI

This is the latest version of Azure Native. Use the Azure Native v1 docs if using the v1 version of this package.

Azure Native v2.63.0 published on Tuesday, Sep 24, 2024 by Pulumi

pulumi/pulumi-azure-native

Example Usage

Create a new vault or update an existing vault

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var vault = new AzureNative.KeyVault.Vault("vault", new()
    {
        Location = "westus",
        Properties = new AzureNative.KeyVault.Inputs.VaultPropertiesArgs
        {
            AccessPolicies = new[]
            {
                new AzureNative.KeyVault.Inputs.AccessPolicyEntryArgs
                {
                    ObjectId = "00000000-0000-0000-0000-000000000000",
                    Permissions = new AzureNative.KeyVault.Inputs.PermissionsArgs
                    {
                        Certificates = new[]
                        {
                            AzureNative.KeyVault.CertificatePermissions.@Get,
                            AzureNative.KeyVault.CertificatePermissions.List,
                            AzureNative.KeyVault.CertificatePermissions.Delete,
                            AzureNative.KeyVault.CertificatePermissions.Create,
                            AzureNative.KeyVault.CertificatePermissions.Import,
                            AzureNative.KeyVault.CertificatePermissions.Update,
                            AzureNative.KeyVault.CertificatePermissions.Managecontacts,
                            AzureNative.KeyVault.CertificatePermissions.Getissuers,
                            AzureNative.KeyVault.CertificatePermissions.Listissuers,
                            AzureNative.KeyVault.CertificatePermissions.Setissuers,
                            AzureNative.KeyVault.CertificatePermissions.Deleteissuers,
                            AzureNative.KeyVault.CertificatePermissions.Manageissuers,
                            AzureNative.KeyVault.CertificatePermissions.Recover,
                            AzureNative.KeyVault.CertificatePermissions.Purge,
                        },
                        Keys = new[]
                        {
                            AzureNative.KeyVault.KeyPermissions.Encrypt,
                            AzureNative.KeyVault.KeyPermissions.Decrypt,
                            AzureNative.KeyVault.KeyPermissions.WrapKey,
                            AzureNative.KeyVault.KeyPermissions.UnwrapKey,
                            AzureNative.KeyVault.KeyPermissions.Sign,
                            AzureNative.KeyVault.KeyPermissions.Verify,
                            AzureNative.KeyVault.KeyPermissions.@Get,
                            AzureNative.KeyVault.KeyPermissions.List,
                            AzureNative.KeyVault.KeyPermissions.Create,
                            AzureNative.KeyVault.KeyPermissions.Update,
                            AzureNative.KeyVault.KeyPermissions.Import,
                            AzureNative.KeyVault.KeyPermissions.Delete,
                            AzureNative.KeyVault.KeyPermissions.Backup,
                            AzureNative.KeyVault.KeyPermissions.Restore,
                            AzureNative.KeyVault.KeyPermissions.Recover,
                            AzureNative.KeyVault.KeyPermissions.Purge,
                        },
                        Secrets = new[]
                        {
                            AzureNative.KeyVault.SecretPermissions.@Get,
                            AzureNative.KeyVault.SecretPermissions.List,
                            AzureNative.KeyVault.SecretPermissions.@Set,
                            AzureNative.KeyVault.SecretPermissions.Delete,
                            AzureNative.KeyVault.SecretPermissions.Backup,
                            AzureNative.KeyVault.SecretPermissions.Restore,
                            AzureNative.KeyVault.SecretPermissions.Recover,
                            AzureNative.KeyVault.SecretPermissions.Purge,
                        },
                    },
                    TenantId = "00000000-0000-0000-0000-000000000000",
                },
            },
            EnabledForDeployment = true,
            EnabledForDiskEncryption = true,
            EnabledForTemplateDeployment = true,
            PublicNetworkAccess = "Enabled",
            Sku = new AzureNative.KeyVault.Inputs.SkuArgs
            {
                Family = AzureNative.KeyVault.SkuFamily.A,
                Name = AzureNative.KeyVault.SkuName.Standard,
            },
            TenantId = "00000000-0000-0000-0000-000000000000",
        },
        ResourceGroupName = "sample-resource-group",
        VaultName = "sample-vault",
    });

});

package main

import (
	keyvault "github.com/pulumi/pulumi-azure-native-sdk/keyvault/v2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keyvault.NewVault(ctx, "vault", &keyvault.VaultArgs{
			Location: pulumi.String("westus"),
			Properties: &keyvault.VaultPropertiesArgs{
				AccessPolicies: keyvault.AccessPolicyEntryArray{
					&keyvault.AccessPolicyEntryArgs{
						ObjectId: pulumi.String("00000000-0000-0000-0000-000000000000"),
						Permissions: &keyvault.PermissionsArgs{
							Certificates: pulumi.StringArray{
								pulumi.String(keyvault.CertificatePermissionsGet),
								pulumi.String(keyvault.CertificatePermissionsList),
								pulumi.String(keyvault.CertificatePermissionsDelete),
								pulumi.String(keyvault.CertificatePermissionsCreate),
								pulumi.String(keyvault.CertificatePermissionsImport),
								pulumi.String(keyvault.CertificatePermissionsUpdate),
								pulumi.String(keyvault.CertificatePermissionsManagecontacts),
								pulumi.String(keyvault.CertificatePermissionsGetissuers),
								pulumi.String(keyvault.CertificatePermissionsListissuers),
								pulumi.String(keyvault.CertificatePermissionsSetissuers),
								pulumi.String(keyvault.CertificatePermissionsDeleteissuers),
								pulumi.String(keyvault.CertificatePermissionsManageissuers),
								pulumi.String(keyvault.CertificatePermissionsRecover),
								pulumi.String(keyvault.CertificatePermissionsPurge),
							},
							Keys: pulumi.StringArray{
								pulumi.String(keyvault.KeyPermissionsEncrypt),
								pulumi.String(keyvault.KeyPermissionsDecrypt),
								pulumi.String(keyvault.KeyPermissionsWrapKey),
								pulumi.String(keyvault.KeyPermissionsUnwrapKey),
								pulumi.String(keyvault.KeyPermissionsSign),
								pulumi.String(keyvault.KeyPermissionsVerify),
								pulumi.String(keyvault.KeyPermissionsGet),
								pulumi.String(keyvault.KeyPermissionsList),
								pulumi.String(keyvault.KeyPermissionsCreate),
								pulumi.String(keyvault.KeyPermissionsUpdate),
								pulumi.String(keyvault.KeyPermissionsImport),
								pulumi.String(keyvault.KeyPermissionsDelete),
								pulumi.String(keyvault.KeyPermissionsBackup),
								pulumi.String(keyvault.KeyPermissionsRestore),
								pulumi.String(keyvault.KeyPermissionsRecover),
								pulumi.String(keyvault.KeyPermissionsPurge),
							},
							Secrets: pulumi.StringArray{
								pulumi.String(keyvault.SecretPermissionsGet),
								pulumi.String(keyvault.SecretPermissionsList),
								pulumi.String(keyvault.SecretPermissionsSet),
								pulumi.String(keyvault.SecretPermissionsDelete),
								pulumi.String(keyvault.SecretPermissionsBackup),
								pulumi.String(keyvault.SecretPermissionsRestore),
								pulumi.String(keyvault.SecretPermissionsRecover),
								pulumi.String(keyvault.SecretPermissionsPurge),
							},
						},
						TenantId: pulumi.String("00000000-0000-0000-0000-000000000000"),
					},
				},
				EnabledForDeployment:         pulumi.Bool(true),
				EnabledForDiskEncryption:     pulumi.Bool(true),
				EnabledForTemplateDeployment: pulumi.Bool(true),
				PublicNetworkAccess:          pulumi.String("Enabled"),
				Sku: &keyvault.SkuArgs{
					Family: pulumi.String(keyvault.SkuFamilyA),
					Name:   keyvault.SkuNameStandard,
				},
				TenantId: pulumi.String("00000000-0000-0000-0000-000000000000"),
			},
			ResourceGroupName: pulumi.String("sample-resource-group"),
			VaultName:         pulumi.String("sample-vault"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.keyvault.Vault;
import com.pulumi.azurenative.keyvault.VaultArgs;
import com.pulumi.azurenative.keyvault.inputs.VaultPropertiesArgs;
import com.pulumi.azurenative.keyvault.inputs.SkuArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var vault = new Vault("vault", VaultArgs.builder()
            .location("westus")
            .properties(VaultPropertiesArgs.builder()
                .accessPolicies(AccessPolicyEntryArgs.builder()
                    .objectId("00000000-0000-0000-0000-000000000000")
                    .permissions(PermissionsArgs.builder()
                        .certificates(                        
                            "get",
                            "list",
                            "delete",
                            "create",
                            "import",
                            "update",
                            "managecontacts",
                            "getissuers",
                            "listissuers",
                            "setissuers",
                            "deleteissuers",
                            "manageissuers",
                            "recover",
                            "purge")
                        .keys(                        
                            "encrypt",
                            "decrypt",
                            "wrapKey",
                            "unwrapKey",
                            "sign",
                            "verify",
                            "get",
                            "list",
                            "create",
                            "update",
                            "import",
                            "delete",
                            "backup",
                            "restore",
                            "recover",
                            "purge")
                        .secrets(                        
                            "get",
                            "list",
                            "set",
                            "delete",
                            "backup",
                            "restore",
                            "recover",
                            "purge")
                        .build())
                    .tenantId("00000000-0000-0000-0000-000000000000")
                    .build())
                .enabledForDeployment(true)
                .enabledForDiskEncryption(true)
                .enabledForTemplateDeployment(true)
                .publicNetworkAccess("Enabled")
                .sku(SkuArgs.builder()
                    .family("A")
                    .name("standard")
                    .build())
                .tenantId("00000000-0000-0000-0000-000000000000")
                .build())
            .resourceGroupName("sample-resource-group")
            .vaultName("sample-vault")
            .build());

    }
}

import pulumi
import pulumi_azure_native as azure_native

vault = azure_native.keyvault.Vault("vault",
    location="westus",
    properties={
        "access_policies": [{
            "object_id": "00000000-0000-0000-0000-000000000000",
            "permissions": {
                "certificates": [
                    azure_native.keyvault.CertificatePermissions.GET,
                    azure_native.keyvault.CertificatePermissions.LIST,
                    azure_native.keyvault.CertificatePermissions.DELETE,
                    azure_native.keyvault.CertificatePermissions.CREATE,
                    azure_native.keyvault.CertificatePermissions.IMPORT_,
                    azure_native.keyvault.CertificatePermissions.UPDATE,
                    azure_native.keyvault.CertificatePermissions.MANAGECONTACTS,
                    azure_native.keyvault.CertificatePermissions.GETISSUERS,
                    azure_native.keyvault.CertificatePermissions.LISTISSUERS,
                    azure_native.keyvault.CertificatePermissions.SETISSUERS,
                    azure_native.keyvault.CertificatePermissions.DELETEISSUERS,
                    azure_native.keyvault.CertificatePermissions.MANAGEISSUERS,
                    azure_native.keyvault.CertificatePermissions.RECOVER,
                    azure_native.keyvault.CertificatePermissions.PURGE,
                ],
                "keys": [
                    azure_native.keyvault.KeyPermissions.ENCRYPT,
                    azure_native.keyvault.KeyPermissions.DECRYPT,
                    azure_native.keyvault.KeyPermissions.WRAP_KEY,
                    azure_native.keyvault.KeyPermissions.UNWRAP_KEY,
                    azure_native.keyvault.KeyPermissions.SIGN,
                    azure_native.keyvault.KeyPermissions.VERIFY,
                    azure_native.keyvault.KeyPermissions.GET,
                    azure_native.keyvault.KeyPermissions.LIST,
                    azure_native.keyvault.KeyPermissions.CREATE,
                    azure_native.keyvault.KeyPermissions.UPDATE,
                    azure_native.keyvault.KeyPermissions.IMPORT_,
                    azure_native.keyvault.KeyPermissions.DELETE,
                    azure_native.keyvault.KeyPermissions.BACKUP,
                    azure_native.keyvault.KeyPermissions.RESTORE,
                    azure_native.keyvault.KeyPermissions.RECOVER,
                    azure_native.keyvault.KeyPermissions.PURGE,
                ],
                "secrets": [
                    azure_native.keyvault.SecretPermissions.GET,
                    azure_native.keyvault.SecretPermissions.LIST,
                    azure_native.keyvault.SecretPermissions.SET,
                    azure_native.keyvault.SecretPermissions.DELETE,
                    azure_native.keyvault.SecretPermissions.BACKUP,
                    azure_native.keyvault.SecretPermissions.RESTORE,
                    azure_native.keyvault.SecretPermissions.RECOVER,
                    azure_native.keyvault.SecretPermissions.PURGE,
                ],
            },
            "tenant_id": "00000000-0000-0000-0000-000000000000",
        }],
        "enabled_for_deployment": True,
        "enabled_for_disk_encryption": True,
        "enabled_for_template_deployment": True,
        "public_network_access": "Enabled",
        "sku": {
            "family": azure_native.keyvault.SkuFamily.A,
            "name": azure_native.keyvault.SkuName.STANDARD,
        },
        "tenant_id": "00000000-0000-0000-0000-000000000000",
    },
    resource_group_name="sample-resource-group",
    vault_name="sample-vault")

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const vault = new azure_native.keyvault.Vault("vault", {
    location: "westus",
    properties: {
        accessPolicies: [{
            objectId: "00000000-0000-0000-0000-000000000000",
            permissions: {
                certificates: [
                    azure_native.keyvault.CertificatePermissions.Get,
                    azure_native.keyvault.CertificatePermissions.List,
                    azure_native.keyvault.CertificatePermissions.Delete,
                    azure_native.keyvault.CertificatePermissions.Create,
                    azure_native.keyvault.CertificatePermissions.Import,
                    azure_native.keyvault.CertificatePermissions.Update,
                    azure_native.keyvault.CertificatePermissions.Managecontacts,
                    azure_native.keyvault.CertificatePermissions.Getissuers,
                    azure_native.keyvault.CertificatePermissions.Listissuers,
                    azure_native.keyvault.CertificatePermissions.Setissuers,
                    azure_native.keyvault.CertificatePermissions.Deleteissuers,
                    azure_native.keyvault.CertificatePermissions.Manageissuers,
                    azure_native.keyvault.CertificatePermissions.Recover,
                    azure_native.keyvault.CertificatePermissions.Purge,
                ],
                keys: [
                    azure_native.keyvault.KeyPermissions.Encrypt,
                    azure_native.keyvault.KeyPermissions.Decrypt,
                    azure_native.keyvault.KeyPermissions.WrapKey,
                    azure_native.keyvault.KeyPermissions.UnwrapKey,
                    azure_native.keyvault.KeyPermissions.Sign,
                    azure_native.keyvault.KeyPermissions.Verify,
                    azure_native.keyvault.KeyPermissions.Get,
                    azure_native.keyvault.KeyPermissions.List,
                    azure_native.keyvault.KeyPermissions.Create,
                    azure_native.keyvault.KeyPermissions.Update,
                    azure_native.keyvault.KeyPermissions.Import,
                    azure_native.keyvault.KeyPermissions.Delete,
                    azure_native.keyvault.KeyPermissions.Backup,
                    azure_native.keyvault.KeyPermissions.Restore,
                    azure_native.keyvault.KeyPermissions.Recover,
                    azure_native.keyvault.KeyPermissions.Purge,
                ],
                secrets: [
                    azure_native.keyvault.SecretPermissions.Get,
                    azure_native.keyvault.SecretPermissions.List,
                    azure_native.keyvault.SecretPermissions.Set,
                    azure_native.keyvault.SecretPermissions.Delete,
                    azure_native.keyvault.SecretPermissions.Backup,
                    azure_native.keyvault.SecretPermissions.Restore,
                    azure_native.keyvault.SecretPermissions.Recover,
                    azure_native.keyvault.SecretPermissions.Purge,
                ],
            },
            tenantId: "00000000-0000-0000-0000-000000000000",
        }],
        enabledForDeployment: true,
        enabledForDiskEncryption: true,
        enabledForTemplateDeployment: true,
        publicNetworkAccess: "Enabled",
        sku: {
            family: azure_native.keyvault.SkuFamily.A,
            name: azure_native.keyvault.SkuName.Standard,
        },
        tenantId: "00000000-0000-0000-0000-000000000000",
    },
    resourceGroupName: "sample-resource-group",
    vaultName: "sample-vault",
});

resources:
  vault:
    type: azure-native:keyvault:Vault
    properties:
      location: westus
      properties:
        accessPolicies:
          - objectId: 00000000-0000-0000-0000-000000000000
            permissions:
              certificates:
                - get
                - list
                - delete
                - create
                - import
                - update
                - managecontacts
                - getissuers
                - listissuers
                - setissuers
                - deleteissuers
                - manageissuers
                - recover
                - purge
              keys:
                - encrypt
                - decrypt
                - wrapKey
                - unwrapKey
                - sign
                - verify
                - get
                - list
                - create
                - update
                - import
                - delete
                - backup
                - restore
                - recover
                - purge
              secrets:
                - get
                - list
                - set
                - delete
                - backup
                - restore
                - recover
                - purge
            tenantId: 00000000-0000-0000-0000-000000000000
        enabledForDeployment: true
        enabledForDiskEncryption: true
        enabledForTemplateDeployment: true
        publicNetworkAccess: Enabled
        sku:
          family: A
          name: standard
        tenantId: 00000000-0000-0000-0000-000000000000
      resourceGroupName: sample-resource-group
      vaultName: sample-vault

Create or update a vault with network acls

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var vault = new AzureNative.KeyVault.Vault("vault", new()
    {
        Location = "westus",
        Properties = new AzureNative.KeyVault.Inputs.VaultPropertiesArgs
        {
            EnabledForDeployment = true,
            EnabledForDiskEncryption = true,
            EnabledForTemplateDeployment = true,
            NetworkAcls = new AzureNative.KeyVault.Inputs.NetworkRuleSetArgs
            {
                Bypass = AzureNative.KeyVault.NetworkRuleBypassOptions.AzureServices,
                DefaultAction = AzureNative.KeyVault.NetworkRuleAction.Deny,
                IpRules = new[]
                {
                    new AzureNative.KeyVault.Inputs.IPRuleArgs
                    {
                        Value = "124.56.78.91",
                    },
                    new AzureNative.KeyVault.Inputs.IPRuleArgs
                    {
                        Value = "'10.91.4.0/24'",
                    },
                },
                VirtualNetworkRules = new[]
                {
                    new AzureNative.KeyVault.Inputs.VirtualNetworkRuleArgs
                    {
                        Id = "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1",
                    },
                },
            },
            Sku = new AzureNative.KeyVault.Inputs.SkuArgs
            {
                Family = AzureNative.KeyVault.SkuFamily.A,
                Name = AzureNative.KeyVault.SkuName.Standard,
            },
            TenantId = "00000000-0000-0000-0000-000000000000",
        },
        ResourceGroupName = "sample-resource-group",
        VaultName = "sample-vault",
    });

});

package main

import (
	keyvault "github.com/pulumi/pulumi-azure-native-sdk/keyvault/v2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keyvault.NewVault(ctx, "vault", &keyvault.VaultArgs{
			Location: pulumi.String("westus"),
			Properties: &keyvault.VaultPropertiesArgs{
				EnabledForDeployment:         pulumi.Bool(true),
				EnabledForDiskEncryption:     pulumi.Bool(true),
				EnabledForTemplateDeployment: pulumi.Bool(true),
				NetworkAcls: &keyvault.NetworkRuleSetArgs{
					Bypass:        pulumi.String(keyvault.NetworkRuleBypassOptionsAzureServices),
					DefaultAction: pulumi.String(keyvault.NetworkRuleActionDeny),
					IpRules: keyvault.IPRuleArray{
						&keyvault.IPRuleArgs{
							Value: pulumi.String("124.56.78.91"),
						},
						&keyvault.IPRuleArgs{
							Value: pulumi.String("'10.91.4.0/24'"),
						},
					},
					VirtualNetworkRules: keyvault.VirtualNetworkRuleArray{
						&keyvault.VirtualNetworkRuleArgs{
							Id: pulumi.String("/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1"),
						},
					},
				},
				Sku: &keyvault.SkuArgs{
					Family: pulumi.String(keyvault.SkuFamilyA),
					Name:   keyvault.SkuNameStandard,
				},
				TenantId: pulumi.String("00000000-0000-0000-0000-000000000000"),
			},
			ResourceGroupName: pulumi.String("sample-resource-group"),
			VaultName:         pulumi.String("sample-vault"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.keyvault.Vault;
import com.pulumi.azurenative.keyvault.VaultArgs;
import com.pulumi.azurenative.keyvault.inputs.VaultPropertiesArgs;
import com.pulumi.azurenative.keyvault.inputs.NetworkRuleSetArgs;
import com.pulumi.azurenative.keyvault.inputs.SkuArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var vault = new Vault("vault", VaultArgs.builder()
            .location("westus")
            .properties(VaultPropertiesArgs.builder()
                .enabledForDeployment(true)
                .enabledForDiskEncryption(true)
                .enabledForTemplateDeployment(true)
                .networkAcls(NetworkRuleSetArgs.builder()
                    .bypass("AzureServices")
                    .defaultAction("Deny")
                    .ipRules(                    
                        IPRuleArgs.builder()
                            .value("124.56.78.91")
                            .build(),
                        IPRuleArgs.builder()
                            .value("'10.91.4.0/24'")
                            .build())
                    .virtualNetworkRules(VirtualNetworkRuleArgs.builder()
                        .id("/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1")
                        .build())
                    .build())
                .sku(SkuArgs.builder()
                    .family("A")
                    .name("standard")
                    .build())
                .tenantId("00000000-0000-0000-0000-000000000000")
                .build())
            .resourceGroupName("sample-resource-group")
            .vaultName("sample-vault")
            .build());

    }
}

import pulumi
import pulumi_azure_native as azure_native

vault = azure_native.keyvault.Vault("vault",
    location="westus",
    properties={
        "enabled_for_deployment": True,
        "enabled_for_disk_encryption": True,
        "enabled_for_template_deployment": True,
        "network_acls": {
            "bypass": azure_native.keyvault.NetworkRuleBypassOptions.AZURE_SERVICES,
            "default_action": azure_native.keyvault.NetworkRuleAction.DENY,
            "ip_rules": [
                {
                    "value": "124.56.78.91",
                },
                {
                    "value": "'10.91.4.0/24'",
                },
            ],
            "virtual_network_rules": [{
                "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1",
            }],
        },
        "sku": {
            "family": azure_native.keyvault.SkuFamily.A,
            "name": azure_native.keyvault.SkuName.STANDARD,
        },
        "tenant_id": "00000000-0000-0000-0000-000000000000",
    },
    resource_group_name="sample-resource-group",
    vault_name="sample-vault")

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const vault = new azure_native.keyvault.Vault("vault", {
    location: "westus",
    properties: {
        enabledForDeployment: true,
        enabledForDiskEncryption: true,
        enabledForTemplateDeployment: true,
        networkAcls: {
            bypass: azure_native.keyvault.NetworkRuleBypassOptions.AzureServices,
            defaultAction: azure_native.keyvault.NetworkRuleAction.Deny,
            ipRules: [
                {
                    value: "124.56.78.91",
                },
                {
                    value: "'10.91.4.0/24'",
                },
            ],
            virtualNetworkRules: [{
                id: "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1",
            }],
        },
        sku: {
            family: azure_native.keyvault.SkuFamily.A,
            name: azure_native.keyvault.SkuName.Standard,
        },
        tenantId: "00000000-0000-0000-0000-000000000000",
    },
    resourceGroupName: "sample-resource-group",
    vaultName: "sample-vault",
});

resources:
  vault:
    type: azure-native:keyvault:Vault
    properties:
      location: westus
      properties:
        enabledForDeployment: true
        enabledForDiskEncryption: true
        enabledForTemplateDeployment: true
        networkAcls:
          bypass: AzureServices
          defaultAction: Deny
          ipRules:
            - value: 124.56.78.91
            - value: '''10.91.4.0/24'''
          virtualNetworkRules:
            - id: /subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1
        sku:
          family: A
          name: standard
        tenantId: 00000000-0000-0000-0000-000000000000
      resourceGroupName: sample-resource-group
      vaultName: sample-vault

Create Vault Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new Vault(name: string, args: VaultArgs, opts?: CustomResourceOptions);

@overload
def Vault(resource_name: str,
          args: VaultArgs,
          opts: Optional[ResourceOptions] = None)

@overload
def Vault(resource_name: str,
          opts: Optional[ResourceOptions] = None,
          properties: Optional[VaultPropertiesArgs] = None,
          resource_group_name: Optional[str] = None,
          location: Optional[str] = None,
          tags: Optional[Mapping[str, str]] = None,
          vault_name: Optional[str] = None)

func NewVault(ctx *Context, name string, args VaultArgs, opts ...ResourceOption) (*Vault, error)

public Vault(string name, VaultArgs args, CustomResourceOptions? opts = null)

public Vault(String name, VaultArgs args)
public Vault(String name, VaultArgs args, CustomResourceOptions options)

type: azure-native:keyvault:Vault
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args VaultArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args VaultArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args VaultArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args VaultArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args VaultArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var azure_nativeVaultResource = new AzureNative.KeyVault.Vault("azure-nativeVaultResource", new()
{
    Properties = new AzureNative.KeyVault.Inputs.VaultPropertiesArgs
    {
        Sku = new AzureNative.KeyVault.Inputs.SkuArgs
        {
            Family = "string",
            Name = AzureNative.KeyVault.SkuName.Standard,
        },
        TenantId = "string",
        EnabledForDiskEncryption = false,
        EnableRbacAuthorization = false,
        EnableSoftDelete = false,
        EnabledForDeployment = false,
        AccessPolicies = new[]
        {
            new AzureNative.KeyVault.Inputs.AccessPolicyEntryArgs
            {
                ObjectId = "string",
                Permissions = new AzureNative.KeyVault.Inputs.PermissionsArgs
                {
                    Certificates = new[]
                    {
                        "string",
                    },
                    Keys = new[]
                    {
                        "string",
                    },
                    Secrets = new[]
                    {
                        "string",
                    },
                    Storage = new[]
                    {
                        "string",
                    },
                },
                TenantId = "string",
                ApplicationId = "string",
            },
        },
        EnabledForTemplateDeployment = false,
        NetworkAcls = new AzureNative.KeyVault.Inputs.NetworkRuleSetArgs
        {
            Bypass = "string",
            DefaultAction = "string",
            IpRules = new[]
            {
                new AzureNative.KeyVault.Inputs.IPRuleArgs
                {
                    Value = "string",
                },
            },
            VirtualNetworkRules = new[]
            {
                new AzureNative.KeyVault.Inputs.VirtualNetworkRuleArgs
                {
                    Id = "string",
                    IgnoreMissingVnetServiceEndpoint = false,
                },
            },
        },
        ProvisioningState = "string",
        PublicNetworkAccess = "string",
        EnablePurgeProtection = false,
        SoftDeleteRetentionInDays = 0,
        CreateMode = AzureNative.KeyVault.CreateMode.Recover,
        VaultUri = "string",
    },
    ResourceGroupName = "string",
    Location = "string",
    Tags = 
    {
        { "string", "string" },
    },
    VaultName = "string",
});

example, err := keyvault.NewVault(ctx, "azure-nativeVaultResource", &keyvault.VaultArgs{
	Properties: &keyvault.VaultPropertiesArgs{
		Sku: &keyvault.SkuArgs{
			Family: pulumi.String("string"),
			Name:   keyvault.SkuNameStandard,
		},
		TenantId:                 pulumi.String("string"),
		EnabledForDiskEncryption: pulumi.Bool(false),
		EnableRbacAuthorization:  pulumi.Bool(false),
		EnableSoftDelete:         pulumi.Bool(false),
		EnabledForDeployment:     pulumi.Bool(false),
		AccessPolicies: keyvault.AccessPolicyEntryArray{
			&keyvault.AccessPolicyEntryArgs{
				ObjectId: pulumi.String("string"),
				Permissions: &keyvault.PermissionsArgs{
					Certificates: pulumi.StringArray{
						pulumi.String("string"),
					},
					Keys: pulumi.StringArray{
						pulumi.String("string"),
					},
					Secrets: pulumi.StringArray{
						pulumi.String("string"),
					},
					Storage: pulumi.StringArray{
						pulumi.String("string"),
					},
				},
				TenantId:      pulumi.String("string"),
				ApplicationId: pulumi.String("string"),
			},
		},
		EnabledForTemplateDeployment: pulumi.Bool(false),
		NetworkAcls: &keyvault.NetworkRuleSetArgs{
			Bypass:        pulumi.String("string"),
			DefaultAction: pulumi.String("string"),
			IpRules: keyvault.IPRuleArray{
				&keyvault.IPRuleArgs{
					Value: pulumi.String("string"),
				},
			},
			VirtualNetworkRules: keyvault.VirtualNetworkRuleArray{
				&keyvault.VirtualNetworkRuleArgs{
					Id:                               pulumi.String("string"),
					IgnoreMissingVnetServiceEndpoint: pulumi.Bool(false),
				},
			},
		},
		ProvisioningState:         pulumi.String("string"),
		PublicNetworkAccess:       pulumi.String("string"),
		EnablePurgeProtection:     pulumi.Bool(false),
		SoftDeleteRetentionInDays: pulumi.Int(0),
		CreateMode:                keyvault.CreateModeRecover,
		VaultUri:                  pulumi.String("string"),
	},
	ResourceGroupName: pulumi.String("string"),
	Location:          pulumi.String("string"),
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	VaultName: pulumi.String("string"),
})

var azure_nativeVaultResource = new Vault("azure-nativeVaultResource", VaultArgs.builder()
    .properties(VaultPropertiesArgs.builder()
        .sku(SkuArgs.builder()
            .family("string")
            .name("standard")
            .build())
        .tenantId("string")
        .enabledForDiskEncryption(false)
        .enableRbacAuthorization(false)
        .enableSoftDelete(false)
        .enabledForDeployment(false)
        .accessPolicies(AccessPolicyEntryArgs.builder()
            .objectId("string")
            .permissions(PermissionsArgs.builder()
                .certificates("string")
                .keys("string")
                .secrets("string")
                .storage("string")
                .build())
            .tenantId("string")
            .applicationId("string")
            .build())
        .enabledForTemplateDeployment(false)
        .networkAcls(NetworkRuleSetArgs.builder()
            .bypass("string")
            .defaultAction("string")
            .ipRules(IPRuleArgs.builder()
                .value("string")
                .build())
            .virtualNetworkRules(VirtualNetworkRuleArgs.builder()
                .id("string")
                .ignoreMissingVnetServiceEndpoint(false)
                .build())
            .build())
        .provisioningState("string")
        .publicNetworkAccess("string")
        .enablePurgeProtection(false)
        .softDeleteRetentionInDays(0)
        .createMode("recover")
        .vaultUri("string")
        .build())
    .resourceGroupName("string")
    .location("string")
    .tags(Map.of("string", "string"))
    .vaultName("string")
    .build());

azure_native_vault_resource = azure_native.keyvault.Vault("azure-nativeVaultResource",
    properties={
        "sku": {
            "family": "string",
            "name": azure_native.keyvault.SkuName.STANDARD,
        },
        "tenantId": "string",
        "enabledForDiskEncryption": False,
        "enableRbacAuthorization": False,
        "enableSoftDelete": False,
        "enabledForDeployment": False,
        "accessPolicies": [{
            "objectId": "string",
            "permissions": {
                "certificates": ["string"],
                "keys": ["string"],
                "secrets": ["string"],
                "storage": ["string"],
            },
            "tenantId": "string",
            "applicationId": "string",
        }],
        "enabledForTemplateDeployment": False,
        "networkAcls": {
            "bypass": "string",
            "defaultAction": "string",
            "ipRules": [{
                "value": "string",
            }],
            "virtualNetworkRules": [{
                "id": "string",
                "ignoreMissingVnetServiceEndpoint": False,
            }],
        },
        "provisioningState": "string",
        "publicNetworkAccess": "string",
        "enablePurgeProtection": False,
        "softDeleteRetentionInDays": 0,
        "createMode": azure_native.keyvault.CreateMode.RECOVER,
        "vaultUri": "string",
    },
    resource_group_name="string",
    location="string",
    tags={
        "string": "string",
    },
    vault_name="string")

const azure_nativeVaultResource = new azure_native.keyvault.Vault("azure-nativeVaultResource", {
    properties: {
        sku: {
            family: "string",
            name: azure_native.keyvault.SkuName.Standard,
        },
        tenantId: "string",
        enabledForDiskEncryption: false,
        enableRbacAuthorization: false,
        enableSoftDelete: false,
        enabledForDeployment: false,
        accessPolicies: [{
            objectId: "string",
            permissions: {
                certificates: ["string"],
                keys: ["string"],
                secrets: ["string"],
                storage: ["string"],
            },
            tenantId: "string",
            applicationId: "string",
        }],
        enabledForTemplateDeployment: false,
        networkAcls: {
            bypass: "string",
            defaultAction: "string",
            ipRules: [{
                value: "string",
            }],
            virtualNetworkRules: [{
                id: "string",
                ignoreMissingVnetServiceEndpoint: false,
            }],
        },
        provisioningState: "string",
        publicNetworkAccess: "string",
        enablePurgeProtection: false,
        softDeleteRetentionInDays: 0,
        createMode: azure_native.keyvault.CreateMode.Recover,
        vaultUri: "string",
    },
    resourceGroupName: "string",
    location: "string",
    tags: {
        string: "string",
    },
    vaultName: "string",
});

type: azure-native:keyvault:Vault
properties:
    location: string
    properties:
        accessPolicies:
            - applicationId: string
              objectId: string
              permissions:
                certificates:
                    - string
                keys:
                    - string
                secrets:
                    - string
                storage:
                    - string
              tenantId: string
        createMode: recover
        enablePurgeProtection: false
        enableRbacAuthorization: false
        enableSoftDelete: false
        enabledForDeployment: false
        enabledForDiskEncryption: false
        enabledForTemplateDeployment: false
        networkAcls:
            bypass: string
            defaultAction: string
            ipRules:
                - value: string
            virtualNetworkRules:
                - id: string
                  ignoreMissingVnetServiceEndpoint: false
        provisioningState: string
        publicNetworkAccess: string
        sku:
            family: string
            name: standard
        softDeleteRetentionInDays: 0
        tenantId: string
        vaultUri: string
    resourceGroupName: string
    tags:
        string: string
    vaultName: string

Vault Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The Vault resource accepts the following input properties:

Properties Pulumi.AzureNative.KeyVault.Inputs.VaultProperties: Properties of the vault
ResourceGroupName string: The name of the Resource Group to which the server belongs.
Location string: The supported Azure location where the key vault should be created.
Tags Dictionary<string, string>: The tags that will be assigned to the key vault.
VaultName string: Name of the vault

Properties VaultPropertiesArgs: Properties of the vault
ResourceGroupName string: The name of the Resource Group to which the server belongs.
Location string: The supported Azure location where the key vault should be created.
Tags map[string]string: The tags that will be assigned to the key vault.
VaultName string: Name of the vault

properties VaultProperties: Properties of the vault
resourceGroupName String: The name of the Resource Group to which the server belongs.
location String: The supported Azure location where the key vault should be created.
tags Map<String,String>: The tags that will be assigned to the key vault.
vaultName String: Name of the vault

properties VaultProperties: Properties of the vault
resourceGroupName string: The name of the Resource Group to which the server belongs.
location string: The supported Azure location where the key vault should be created.
tags {[key: string]: string}: The tags that will be assigned to the key vault.
vaultName string: Name of the vault

properties VaultPropertiesArgs: Properties of the vault
resource_group_name str: The name of the Resource Group to which the server belongs.
location str: The supported Azure location where the key vault should be created.
tags Mapping[str, str]: The tags that will be assigned to the key vault.
vault_name str: Name of the vault

properties Property Map: Properties of the vault
resourceGroupName String: The name of the Resource Group to which the server belongs.
location String: The supported Azure location where the key vault should be created.
tags Map<String>: The tags that will be assigned to the key vault.
vaultName String: Name of the vault

Outputs

All input properties are implicitly available as output properties. Additionally, the Vault resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.
Name string: Name of the key vault resource.
SystemData Pulumi.AzureNative.KeyVault.Outputs.SystemDataResponse: System metadata for the key vault.
Type string: Resource type of the key vault resource.

Id string: The provider-assigned unique ID for this managed resource.
Name string: Name of the key vault resource.
SystemData SystemDataResponse: System metadata for the key vault.
Type string: Resource type of the key vault resource.

id String: The provider-assigned unique ID for this managed resource.
name String: Name of the key vault resource.
systemData SystemDataResponse: System metadata for the key vault.
type String: Resource type of the key vault resource.

id string: The provider-assigned unique ID for this managed resource.
name string: Name of the key vault resource.
systemData SystemDataResponse: System metadata for the key vault.
type string: Resource type of the key vault resource.

id str: The provider-assigned unique ID for this managed resource.
name str: Name of the key vault resource.
system_data SystemDataResponse: System metadata for the key vault.
type str: Resource type of the key vault resource.

id String: The provider-assigned unique ID for this managed resource.
name String: Name of the key vault resource.
systemData Property Map: System metadata for the key vault.
type String: Resource type of the key vault resource.

Supporting Types

AccessPolicyEntry, AccessPolicyEntryArgs

ObjectId string: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
Permissions Pulumi.AzureNative.KeyVault.Inputs.Permissions: Permissions the identity has for keys, secrets and certificates.
TenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
ApplicationId string: Application ID of the client making request on behalf of a principal

ObjectId string: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
Permissions Permissions: Permissions the identity has for keys, secrets and certificates.
TenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
ApplicationId string: Application ID of the client making request on behalf of a principal

objectId String: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
permissions Permissions: Permissions the identity has for keys, secrets and certificates.
tenantId String: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
applicationId String: Application ID of the client making request on behalf of a principal

objectId string: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
permissions Permissions: Permissions the identity has for keys, secrets and certificates.
tenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
applicationId string: Application ID of the client making request on behalf of a principal

object_id str: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
permissions Permissions: Permissions the identity has for keys, secrets and certificates.
tenant_id str: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
application_id str: Application ID of the client making request on behalf of a principal

objectId String: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
permissions Property Map: Permissions the identity has for keys, secrets and certificates.
tenantId String: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
applicationId String: Application ID of the client making request on behalf of a principal

AccessPolicyEntryResponse, AccessPolicyEntryResponseArgs

ObjectId string: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
Permissions Pulumi.AzureNative.KeyVault.Inputs.PermissionsResponse: Permissions the identity has for keys, secrets and certificates.
TenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
ApplicationId string: Application ID of the client making request on behalf of a principal

ObjectId string: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
Permissions PermissionsResponse: Permissions the identity has for keys, secrets and certificates.
TenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
ApplicationId string: Application ID of the client making request on behalf of a principal

objectId String: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
permissions PermissionsResponse: Permissions the identity has for keys, secrets and certificates.
tenantId String: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
applicationId String: Application ID of the client making request on behalf of a principal

objectId string: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
permissions PermissionsResponse: Permissions the identity has for keys, secrets and certificates.
tenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
applicationId string: Application ID of the client making request on behalf of a principal

object_id str: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
permissions PermissionsResponse: Permissions the identity has for keys, secrets and certificates.
tenant_id str: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
application_id str: Application ID of the client making request on behalf of a principal

objectId String: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
permissions Property Map: Permissions the identity has for keys, secrets and certificates.
tenantId String: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
applicationId String: Application ID of the client making request on behalf of a principal

CertificatePermissions, CertificatePermissionsArgs

All: all
@Get: get
List: list
Delete: delete
Create: create
Import: import
Update: update
Managecontacts: managecontacts
Getissuers: getissuers
Listissuers: listissuers
Setissuers: setissuers
Deleteissuers: deleteissuers
Manageissuers: manageissuers
Recover: recover
Purge: purge
Backup: backup
Restore: restore

CertificatePermissionsAll: all
CertificatePermissionsGet: get
CertificatePermissionsList: list
CertificatePermissionsDelete: delete
CertificatePermissionsCreate: create
CertificatePermissionsImport: import
CertificatePermissionsUpdate: update
CertificatePermissionsManagecontacts: managecontacts
CertificatePermissionsGetissuers: getissuers
CertificatePermissionsListissuers: listissuers
CertificatePermissionsSetissuers: setissuers
CertificatePermissionsDeleteissuers: deleteissuers
CertificatePermissionsManageissuers: manageissuers
CertificatePermissionsRecover: recover
CertificatePermissionsPurge: purge
CertificatePermissionsBackup: backup
CertificatePermissionsRestore: restore

All: all
Get: get
List: list
Delete: delete
Create: create
Import_: import
Update: update
Managecontacts: managecontacts
Getissuers: getissuers
Listissuers: listissuers
Setissuers: setissuers
Deleteissuers: deleteissuers
Manageissuers: manageissuers
Recover: recover
Purge: purge
Backup: backup
Restore: restore

All: all
Get: get
List: list
Delete: delete
Create: create
Import: import
Update: update
Managecontacts: managecontacts
Getissuers: getissuers
Listissuers: listissuers
Setissuers: setissuers
Deleteissuers: deleteissuers
Manageissuers: manageissuers
Recover: recover
Purge: purge
Backup: backup
Restore: restore

ALL: all
GET: get
LIST: list
DELETE: delete
CREATE: create
IMPORT_: import
UPDATE: update
MANAGECONTACTS: managecontacts
GETISSUERS: getissuers
LISTISSUERS: listissuers
SETISSUERS: setissuers
DELETEISSUERS: deleteissuers
MANAGEISSUERS: manageissuers
RECOVER: recover
PURGE: purge
BACKUP: backup
RESTORE: restore

"all": all
"get": get
"list": list
"delete": delete
"create": create
"import": import
"update": update
"managecontacts": managecontacts
"getissuers": getissuers
"listissuers": listissuers
"setissuers": setissuers
"deleteissuers": deleteissuers
"manageissuers": manageissuers
"recover": recover
"purge": purge
"backup": backup
"restore": restore

CreateMode, CreateModeArgs

Recover: recover
@Default: default

CreateModeRecover: recover
CreateModeDefault: default

Recover: recover
Default_: default

Recover: recover
Default: default

RECOVER: recover
DEFAULT: default

"recover": recover
"default": default

IPRule, IPRuleArgs

Value string: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

Value string: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

value String: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

value string: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

value str: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

value String: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

IPRuleResponse, IPRuleResponseArgs

Value string: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

Value string: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

value String: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

value string: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

value str: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

value String: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).

KeyPermissions, KeyPermissionsArgs

All: all
Encrypt: encrypt
Decrypt: decrypt
WrapKey: wrapKey
UnwrapKey: unwrapKey
Sign: sign
Verify: verify
@Get: get
List: list
Create: create
Update: update
Import: import
Delete: delete
Backup: backup
Restore: restore
Recover: recover
Purge: purge
Release: release
Rotate: rotate
Getrotationpolicy: getrotationpolicy
Setrotationpolicy: setrotationpolicy

KeyPermissionsAll: all
KeyPermissionsEncrypt: encrypt
KeyPermissionsDecrypt: decrypt
KeyPermissionsWrapKey: wrapKey
KeyPermissionsUnwrapKey: unwrapKey
KeyPermissionsSign: sign
KeyPermissionsVerify: verify
KeyPermissionsGet: get
KeyPermissionsList: list
KeyPermissionsCreate: create
KeyPermissionsUpdate: update
KeyPermissionsImport: import
KeyPermissionsDelete: delete
KeyPermissionsBackup: backup
KeyPermissionsRestore: restore
KeyPermissionsRecover: recover
KeyPermissionsPurge: purge
KeyPermissionsRelease: release
KeyPermissionsRotate: rotate
KeyPermissionsGetrotationpolicy: getrotationpolicy
KeyPermissionsSetrotationpolicy: setrotationpolicy

All: all
Encrypt: encrypt
Decrypt: decrypt
WrapKey: wrapKey
UnwrapKey: unwrapKey
Sign: sign
Verify: verify
Get: get
List: list
Create: create
Update: update
Import_: import
Delete: delete
Backup: backup
Restore: restore
Recover: recover
Purge: purge
Release: release
Rotate: rotate
Getrotationpolicy: getrotationpolicy
Setrotationpolicy: setrotationpolicy

All: all
Encrypt: encrypt
Decrypt: decrypt
WrapKey: wrapKey
UnwrapKey: unwrapKey
Sign: sign
Verify: verify
Get: get
List: list
Create: create
Update: update
Import: import
Delete: delete
Backup: backup
Restore: restore
Recover: recover
Purge: purge
Release: release
Rotate: rotate
Getrotationpolicy: getrotationpolicy
Setrotationpolicy: setrotationpolicy

ALL: all
ENCRYPT: encrypt
DECRYPT: decrypt
WRAP_KEY: wrapKey
UNWRAP_KEY: unwrapKey
SIGN: sign
VERIFY: verify
GET: get
LIST: list
CREATE: create
UPDATE: update
IMPORT_: import
DELETE: delete
BACKUP: backup
RESTORE: restore
RECOVER: recover
PURGE: purge
RELEASE: release
ROTATE: rotate
GETROTATIONPOLICY: getrotationpolicy
SETROTATIONPOLICY: setrotationpolicy

"all": all
"encrypt": encrypt
"decrypt": decrypt
"wrapKey": wrapKey
"unwrapKey": unwrapKey
"sign": sign
"verify": verify
"get": get
"list": list
"create": create
"update": update
"import": import
"delete": delete
"backup": backup
"restore": restore
"recover": recover
"purge": purge
"release": release
"rotate": rotate
"getrotationpolicy": getrotationpolicy
"setrotationpolicy": setrotationpolicy

NetworkRuleAction, NetworkRuleActionArgs

Allow: Allow
Deny: Deny

NetworkRuleActionAllow: Allow
NetworkRuleActionDeny: Deny

Allow: Allow
Deny: Deny

Allow: Allow
Deny: Deny

ALLOW: Allow
DENY: Deny

"Allow": Allow
"Deny": Deny

NetworkRuleBypassOptions, NetworkRuleBypassOptionsArgs

AzureServices: AzureServices
None: None

NetworkRuleBypassOptionsAzureServices: AzureServices
NetworkRuleBypassOptionsNone: None

AzureServices: AzureServices
None: None

AzureServices: AzureServices
None: None

AZURE_SERVICES: AzureServices
NONE: None

"AzureServices": AzureServices
"None": None

NetworkRuleSet, NetworkRuleSetArgs

Bypass string | Pulumi.AzureNative.KeyVault.NetworkRuleBypassOptions: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
DefaultAction string | Pulumi.AzureNative.KeyVault.NetworkRuleAction: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
IpRules List<Pulumi.AzureNative.KeyVault.Inputs.IPRule>: The list of IP address rules.
VirtualNetworkRules List<Pulumi.AzureNative.KeyVault.Inputs.VirtualNetworkRule>: The list of virtual network rules.

Bypass string | NetworkRuleBypassOptions: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
DefaultAction string | NetworkRuleAction: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
IpRules []IPRule: The list of IP address rules.
VirtualNetworkRules []VirtualNetworkRule: The list of virtual network rules.

bypass String | NetworkRuleBypassOptions: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
defaultAction String | NetworkRuleAction: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
ipRules List<IPRule>: The list of IP address rules.
virtualNetworkRules List<VirtualNetworkRule>: The list of virtual network rules.

bypass string | NetworkRuleBypassOptions: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
defaultAction string | NetworkRuleAction: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
ipRules IPRule[]: The list of IP address rules.
virtualNetworkRules VirtualNetworkRule[]: The list of virtual network rules.

bypass str | NetworkRuleBypassOptions: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
default_action str | NetworkRuleAction: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
ip_rules Sequence[IPRule]: The list of IP address rules.
virtual_network_rules Sequence[VirtualNetworkRule]: The list of virtual network rules.

bypass String | "AzureServices" | "None": Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
defaultAction String | "Allow" | "Deny": The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
ipRules List<Property Map>: The list of IP address rules.
virtualNetworkRules List<Property Map>: The list of virtual network rules.

NetworkRuleSetResponse, NetworkRuleSetResponseArgs

Bypass string: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
DefaultAction string: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
IpRules List<Pulumi.AzureNative.KeyVault.Inputs.IPRuleResponse>: The list of IP address rules.
VirtualNetworkRules List<Pulumi.AzureNative.KeyVault.Inputs.VirtualNetworkRuleResponse>: The list of virtual network rules.

Bypass string: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
DefaultAction string: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
IpRules []IPRuleResponse: The list of IP address rules.
VirtualNetworkRules []VirtualNetworkRuleResponse: The list of virtual network rules.

bypass String: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
defaultAction String: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
ipRules List<IPRuleResponse>: The list of IP address rules.
virtualNetworkRules List<VirtualNetworkRuleResponse>: The list of virtual network rules.

bypass string: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
defaultAction string: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
ipRules IPRuleResponse[]: The list of IP address rules.
virtualNetworkRules VirtualNetworkRuleResponse[]: The list of virtual network rules.

bypass str: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
default_action str: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
ip_rules Sequence[IPRuleResponse]: The list of IP address rules.
virtual_network_rules Sequence[VirtualNetworkRuleResponse]: The list of virtual network rules.

bypass String: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
defaultAction String: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
ipRules List<Property Map>: The list of IP address rules.
virtualNetworkRules List<Property Map>: The list of virtual network rules.

Permissions, PermissionsArgs

Certificates List<Union<string, Pulumi.AzureNative.KeyVault.CertificatePermissions>>: Permissions to certificates
Keys List<Union<string, Pulumi.AzureNative.KeyVault.KeyPermissions>>: Permissions to keys
Secrets List<Union<string, Pulumi.AzureNative.KeyVault.SecretPermissions>>: Permissions to secrets
Storage List<Union<string, Pulumi.AzureNative.KeyVault.StoragePermissions>>: Permissions to storage accounts

Certificates []string: Permissions to certificates
Keys []string: Permissions to keys
Secrets []string: Permissions to secrets
Storage []string: Permissions to storage accounts

certificates List<Either<String,CertificatePermissions>>: Permissions to certificates
keys List<Either<String,KeyPermissions>>: Permissions to keys
secrets List<Either<String,SecretPermissions>>: Permissions to secrets
storage List<Either<String,StoragePermissions>>: Permissions to storage accounts

certificates (string | CertificatePermissions)[]: Permissions to certificates
keys (string | KeyPermissions)[]: Permissions to keys
secrets (string | SecretPermissions)[]: Permissions to secrets
storage (string | StoragePermissions)[]: Permissions to storage accounts

certificates Sequence[Union[str, CertificatePermissions]]: Permissions to certificates
keys Sequence[Union[str, KeyPermissions]]: Permissions to keys
secrets Sequence[Union[str, SecretPermissions]]: Permissions to secrets
storage Sequence[Union[str, StoragePermissions]]: Permissions to storage accounts

certificates List<String | "all" | "get" | "list" | "delete" | "create" | "import" | "update" | "managecontacts" | "getissuers" | "listissuers" | "setissuers" | "deleteissuers" | "manageissuers" | "recover" | "purge" | "backup" | "restore">: Permissions to certificates
keys List<String | "all" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "sign" | "verify" | "get" | "list" | "create" | "update" | "import" | "delete" | "backup" | "restore" | "recover" | "purge" | "release" | "rotate" | "getrotationpolicy" | "setrotationpolicy">: Permissions to keys
secrets List<String | "all" | "get" | "list" | "set" | "delete" | "backup" | "restore" | "recover" | "purge">: Permissions to secrets
storage List<String | "all" | "get" | "list" | "delete" | "set" | "update" | "regeneratekey" | "recover" | "purge" | "backup" | "restore" | "setsas" | "listsas" | "getsas" | "deletesas">: Permissions to storage accounts

PermissionsResponse, PermissionsResponseArgs

Certificates List<string>: Permissions to certificates
Keys List<string>: Permissions to keys
Secrets List<string>: Permissions to secrets
Storage List<string>: Permissions to storage accounts

Certificates []string: Permissions to certificates
Keys []string: Permissions to keys
Secrets []string: Permissions to secrets
Storage []string: Permissions to storage accounts

certificates List<String>: Permissions to certificates
keys List<String>: Permissions to keys
secrets List<String>: Permissions to secrets
storage List<String>: Permissions to storage accounts

certificates string[]: Permissions to certificates
keys string[]: Permissions to keys
secrets string[]: Permissions to secrets
storage string[]: Permissions to storage accounts

certificates Sequence[str]: Permissions to certificates
keys Sequence[str]: Permissions to keys
secrets Sequence[str]: Permissions to secrets
storage Sequence[str]: Permissions to storage accounts

certificates List<String>: Permissions to certificates
keys List<String>: Permissions to keys
secrets List<String>: Permissions to secrets
storage List<String>: Permissions to storage accounts

PrivateEndpointConnectionItemResponse, PrivateEndpointConnectionItemResponseArgs

ProvisioningState string: Provisioning state of the private endpoint connection.
Etag string: Modified whenever there is a change in the state of private endpoint connection.
Id string: Id of private endpoint connection.
PrivateEndpoint Pulumi.AzureNative.KeyVault.Inputs.PrivateEndpointResponse: Properties of the private endpoint object.
PrivateLinkServiceConnectionState Pulumi.AzureNative.KeyVault.Inputs.PrivateLinkServiceConnectionStateResponse: Approval state of the private link connection.

ProvisioningState string: Provisioning state of the private endpoint connection.
Etag string: Modified whenever there is a change in the state of private endpoint connection.
Id string: Id of private endpoint connection.
PrivateEndpoint PrivateEndpointResponse: Properties of the private endpoint object.
PrivateLinkServiceConnectionState PrivateLinkServiceConnectionStateResponse: Approval state of the private link connection.

provisioningState String: Provisioning state of the private endpoint connection.
etag String: Modified whenever there is a change in the state of private endpoint connection.
id String: Id of private endpoint connection.
privateEndpoint PrivateEndpointResponse: Properties of the private endpoint object.
privateLinkServiceConnectionState PrivateLinkServiceConnectionStateResponse: Approval state of the private link connection.

provisioningState string: Provisioning state of the private endpoint connection.
etag string: Modified whenever there is a change in the state of private endpoint connection.
id string: Id of private endpoint connection.
privateEndpoint PrivateEndpointResponse: Properties of the private endpoint object.
privateLinkServiceConnectionState PrivateLinkServiceConnectionStateResponse: Approval state of the private link connection.

provisioning_state str: Provisioning state of the private endpoint connection.
etag str: Modified whenever there is a change in the state of private endpoint connection.
id str: Id of private endpoint connection.
private_endpoint PrivateEndpointResponse: Properties of the private endpoint object.
private_link_service_connection_state PrivateLinkServiceConnectionStateResponse: Approval state of the private link connection.

provisioningState String: Provisioning state of the private endpoint connection.
etag String: Modified whenever there is a change in the state of private endpoint connection.
id String: Id of private endpoint connection.
privateEndpoint Property Map: Properties of the private endpoint object.
privateLinkServiceConnectionState Property Map: Approval state of the private link connection.

PrivateEndpointResponse, PrivateEndpointResponseArgs

Id string: Full identifier of the private endpoint resource.

Id string: Full identifier of the private endpoint resource.

id String: Full identifier of the private endpoint resource.

id string: Full identifier of the private endpoint resource.

id str: Full identifier of the private endpoint resource.

id String: Full identifier of the private endpoint resource.

PrivateLinkServiceConnectionStateResponse, PrivateLinkServiceConnectionStateResponseArgs

ActionsRequired string: A message indicating if changes on the service provider require any updates on the consumer.
Description string: The reason for approval or rejection.
Status string: Indicates whether the connection has been approved, rejected or removed by the key vault owner.

ActionsRequired string: A message indicating if changes on the service provider require any updates on the consumer.
Description string: The reason for approval or rejection.
Status string: Indicates whether the connection has been approved, rejected or removed by the key vault owner.

actionsRequired String: A message indicating if changes on the service provider require any updates on the consumer.
description String: The reason for approval or rejection.
status String: Indicates whether the connection has been approved, rejected or removed by the key vault owner.

actionsRequired string: A message indicating if changes on the service provider require any updates on the consumer.
description string: The reason for approval or rejection.
status string: Indicates whether the connection has been approved, rejected or removed by the key vault owner.

actions_required str: A message indicating if changes on the service provider require any updates on the consumer.
description str: The reason for approval or rejection.
status str: Indicates whether the connection has been approved, rejected or removed by the key vault owner.

actionsRequired String: A message indicating if changes on the service provider require any updates on the consumer.
description String: The reason for approval or rejection.
status String: Indicates whether the connection has been approved, rejected or removed by the key vault owner.

SecretPermissions, SecretPermissionsArgs

All: all
@Get: get
List: list
@Set: set
Delete: delete
Backup: backup
Restore: restore
Recover: recover
Purge: purge

SecretPermissionsAll: all
SecretPermissionsGet: get
SecretPermissionsList: list
SecretPermissionsSet: set
SecretPermissionsDelete: delete
SecretPermissionsBackup: backup
SecretPermissionsRestore: restore
SecretPermissionsRecover: recover
SecretPermissionsPurge: purge

All: all
Get: get
List: list
Set: set
Delete: delete
Backup: backup
Restore: restore
Recover: recover
Purge: purge

All: all
Get: get
List: list
Set: set
Delete: delete
Backup: backup
Restore: restore
Recover: recover
Purge: purge

ALL: all
GET: get
LIST: list
SET: set
DELETE: delete
BACKUP: backup
RESTORE: restore
RECOVER: recover
PURGE: purge

"all": all
"get": get
"list": list
"set": set
"delete": delete
"backup": backup
"restore": restore
"recover": recover
"purge": purge

Sku, SkuArgs

Family string | Pulumi.AzureNative.KeyVault.SkuFamily: SKU family name
Name Pulumi.AzureNative.KeyVault.SkuName: SKU name to specify whether the key vault is a standard vault or a premium vault.

Family string | SkuFamily: SKU family name
Name SkuName: SKU name to specify whether the key vault is a standard vault or a premium vault.

family String | SkuFamily: SKU family name
name SkuName: SKU name to specify whether the key vault is a standard vault or a premium vault.

family string | SkuFamily: SKU family name
name SkuName: SKU name to specify whether the key vault is a standard vault or a premium vault.

family str | SkuFamily: SKU family name
name SkuName: SKU name to specify whether the key vault is a standard vault or a premium vault.

family String | "A": SKU family name
name "standard" | "premium": SKU name to specify whether the key vault is a standard vault or a premium vault.

SkuFamily, SkuFamilyArgs

A: A

SkuFamilyA: A

A: A

A: A

A: A

"A": A

SkuName, SkuNameArgs

Standard: standard
Premium: premium

SkuNameStandard: standard
SkuNamePremium: premium

Standard: standard
Premium: premium

Standard: standard
Premium: premium

STANDARD: standard
PREMIUM: premium

"standard": standard
"premium": premium

SkuResponse, SkuResponseArgs

Family string: SKU family name
Name string: SKU name to specify whether the key vault is a standard vault or a premium vault.

Family string: SKU family name
Name string: SKU name to specify whether the key vault is a standard vault or a premium vault.

family String: SKU family name
name String: SKU name to specify whether the key vault is a standard vault or a premium vault.

family string: SKU family name
name string: SKU name to specify whether the key vault is a standard vault or a premium vault.

family str: SKU family name
name str: SKU name to specify whether the key vault is a standard vault or a premium vault.

family String: SKU family name
name String: SKU name to specify whether the key vault is a standard vault or a premium vault.

StoragePermissions, StoragePermissionsArgs

All: all
@Get: get
List: list
Delete: delete
@Set: set
Update: update
Regeneratekey: regeneratekey
Recover: recover
Purge: purge
Backup: backup
Restore: restore
Setsas: setsas
Listsas: listsas
Getsas: getsas
Deletesas: deletesas

StoragePermissionsAll: all
StoragePermissionsGet: get
StoragePermissionsList: list
StoragePermissionsDelete: delete
StoragePermissionsSet: set
StoragePermissionsUpdate: update
StoragePermissionsRegeneratekey: regeneratekey
StoragePermissionsRecover: recover
StoragePermissionsPurge: purge
StoragePermissionsBackup: backup
StoragePermissionsRestore: restore
StoragePermissionsSetsas: setsas
StoragePermissionsListsas: listsas
StoragePermissionsGetsas: getsas
StoragePermissionsDeletesas: deletesas

All: all
Get: get
List: list
Delete: delete
Set: set
Update: update
Regeneratekey: regeneratekey
Recover: recover
Purge: purge
Backup: backup
Restore: restore
Setsas: setsas
Listsas: listsas
Getsas: getsas
Deletesas: deletesas

All: all
Get: get
List: list
Delete: delete
Set: set
Update: update
Regeneratekey: regeneratekey
Recover: recover
Purge: purge
Backup: backup
Restore: restore
Setsas: setsas
Listsas: listsas
Getsas: getsas
Deletesas: deletesas

ALL: all
GET: get
LIST: list
DELETE: delete
SET: set
UPDATE: update
REGENERATEKEY: regeneratekey
RECOVER: recover
PURGE: purge
BACKUP: backup
RESTORE: restore
SETSAS: setsas
LISTSAS: listsas
GETSAS: getsas
DELETESAS: deletesas

"all": all
"get": get
"list": list
"delete": delete
"set": set
"update": update
"regeneratekey": regeneratekey
"recover": recover
"purge": purge
"backup": backup
"restore": restore
"setsas": setsas
"listsas": listsas
"getsas": getsas
"deletesas": deletesas

SystemDataResponse, SystemDataResponseArgs

CreatedAt string: The timestamp of the key vault resource creation (UTC).
CreatedBy string: The identity that created the key vault resource.
CreatedByType string: The type of identity that created the key vault resource.
LastModifiedAt string: The timestamp of the key vault resource last modification (UTC).
LastModifiedBy string: The identity that last modified the key vault resource.
LastModifiedByType string: The type of identity that last modified the key vault resource.

CreatedAt string: The timestamp of the key vault resource creation (UTC).
CreatedBy string: The identity that created the key vault resource.
CreatedByType string: The type of identity that created the key vault resource.
LastModifiedAt string: The timestamp of the key vault resource last modification (UTC).
LastModifiedBy string: The identity that last modified the key vault resource.
LastModifiedByType string: The type of identity that last modified the key vault resource.

createdAt String: The timestamp of the key vault resource creation (UTC).
createdBy String: The identity that created the key vault resource.
createdByType String: The type of identity that created the key vault resource.
lastModifiedAt String: The timestamp of the key vault resource last modification (UTC).
lastModifiedBy String: The identity that last modified the key vault resource.
lastModifiedByType String: The type of identity that last modified the key vault resource.

createdAt string: The timestamp of the key vault resource creation (UTC).
createdBy string: The identity that created the key vault resource.
createdByType string: The type of identity that created the key vault resource.
lastModifiedAt string: The timestamp of the key vault resource last modification (UTC).
lastModifiedBy string: The identity that last modified the key vault resource.
lastModifiedByType string: The type of identity that last modified the key vault resource.

created_at str: The timestamp of the key vault resource creation (UTC).
created_by str: The identity that created the key vault resource.
created_by_type str: The type of identity that created the key vault resource.
last_modified_at str: The timestamp of the key vault resource last modification (UTC).
last_modified_by str: The identity that last modified the key vault resource.
last_modified_by_type str: The type of identity that last modified the key vault resource.

createdAt String: The timestamp of the key vault resource creation (UTC).
createdBy String: The identity that created the key vault resource.
createdByType String: The type of identity that created the key vault resource.
lastModifiedAt String: The timestamp of the key vault resource last modification (UTC).
lastModifiedBy String: The identity that last modified the key vault resource.
lastModifiedByType String: The type of identity that last modified the key vault resource.

VaultProperties, VaultPropertiesArgs

Sku Pulumi.AzureNative.KeyVault.Inputs.Sku: SKU details
TenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
AccessPolicies List<Pulumi.AzureNative.KeyVault.Inputs.AccessPolicyEntry>: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
CreateMode Pulumi.AzureNative.KeyVault.CreateMode: The vault's create mode to indicate whether the vault need to be recovered or not.
EnablePurgeProtection bool: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
EnableRbacAuthorization bool: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
EnableSoftDelete bool: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
EnabledForDeployment bool: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
EnabledForDiskEncryption bool: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
EnabledForTemplateDeployment bool: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
NetworkAcls Pulumi.AzureNative.KeyVault.Inputs.NetworkRuleSet: Rules governing the accessibility of the key vault from specific network locations.
ProvisioningState string | Pulumi.AzureNative.KeyVault.VaultProvisioningState: Provisioning state of the vault.
PublicNetworkAccess string: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
SoftDeleteRetentionInDays int: softDelete data retention days. It accepts >=7 and <=90.
VaultUri string: The URI of the vault for performing operations on keys and secrets.

Sku Sku: SKU details
TenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
AccessPolicies []AccessPolicyEntry: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
CreateMode CreateMode: The vault's create mode to indicate whether the vault need to be recovered or not.
EnablePurgeProtection bool: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
EnableRbacAuthorization bool: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
EnableSoftDelete bool: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
EnabledForDeployment bool: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
EnabledForDiskEncryption bool: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
EnabledForTemplateDeployment bool: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
NetworkAcls NetworkRuleSet: Rules governing the accessibility of the key vault from specific network locations.
ProvisioningState string | VaultProvisioningState: Provisioning state of the vault.
PublicNetworkAccess string: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
SoftDeleteRetentionInDays int: softDelete data retention days. It accepts >=7 and <=90.
VaultUri string: The URI of the vault for performing operations on keys and secrets.

sku Sku: SKU details
tenantId String: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
accessPolicies List<AccessPolicyEntry>: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
createMode CreateMode: The vault's create mode to indicate whether the vault need to be recovered or not.
enablePurgeProtection Boolean: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enableRbacAuthorization Boolean: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enableSoftDelete Boolean: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
enabledForDeployment Boolean: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabledForDiskEncryption Boolean: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabledForTemplateDeployment Boolean: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
networkAcls NetworkRuleSet: Rules governing the accessibility of the key vault from specific network locations.
provisioningState String | VaultProvisioningState: Provisioning state of the vault.
publicNetworkAccess String: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
softDeleteRetentionInDays Integer: softDelete data retention days. It accepts >=7 and <=90.
vaultUri String: The URI of the vault for performing operations on keys and secrets.

sku Sku: SKU details
tenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
accessPolicies AccessPolicyEntry[]: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
createMode CreateMode: The vault's create mode to indicate whether the vault need to be recovered or not.
enablePurgeProtection boolean: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enableRbacAuthorization boolean: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enableSoftDelete boolean: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
enabledForDeployment boolean: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabledForDiskEncryption boolean: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabledForTemplateDeployment boolean: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
networkAcls NetworkRuleSet: Rules governing the accessibility of the key vault from specific network locations.
provisioningState string | VaultProvisioningState: Provisioning state of the vault.
publicNetworkAccess string: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
softDeleteRetentionInDays number: softDelete data retention days. It accepts >=7 and <=90.
vaultUri string: The URI of the vault for performing operations on keys and secrets.

sku Sku: SKU details
tenant_id str: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
access_policies Sequence[AccessPolicyEntry]: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
create_mode CreateMode: The vault's create mode to indicate whether the vault need to be recovered or not.
enable_purge_protection bool: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enable_rbac_authorization bool: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enable_soft_delete bool: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
enabled_for_deployment bool: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabled_for_disk_encryption bool: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabled_for_template_deployment bool: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
network_acls NetworkRuleSet: Rules governing the accessibility of the key vault from specific network locations.
provisioning_state str | VaultProvisioningState: Provisioning state of the vault.
public_network_access str: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
soft_delete_retention_in_days int: softDelete data retention days. It accepts >=7 and <=90.
vault_uri str: The URI of the vault for performing operations on keys and secrets.

sku Property Map: SKU details
tenantId String: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
accessPolicies List<Property Map>: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
createMode "recover" | "default": The vault's create mode to indicate whether the vault need to be recovered or not.
enablePurgeProtection Boolean: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enableRbacAuthorization Boolean: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enableSoftDelete Boolean: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
enabledForDeployment Boolean: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabledForDiskEncryption Boolean: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabledForTemplateDeployment Boolean: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
networkAcls Property Map: Rules governing the accessibility of the key vault from specific network locations.
provisioningState String | "Succeeded" | "RegisteringDns": Provisioning state of the vault.
publicNetworkAccess String: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
softDeleteRetentionInDays Number: softDelete data retention days. It accepts >=7 and <=90.
vaultUri String: The URI of the vault for performing operations on keys and secrets.

VaultPropertiesResponse, VaultPropertiesResponseArgs

HsmPoolResourceId string: The resource id of HSM Pool.
PrivateEndpointConnections List<Pulumi.AzureNative.KeyVault.Inputs.PrivateEndpointConnectionItemResponse>: List of private endpoint connections associated with the key vault.
Sku Pulumi.AzureNative.KeyVault.Inputs.SkuResponse: SKU details
TenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
AccessPolicies List<Pulumi.AzureNative.KeyVault.Inputs.AccessPolicyEntryResponse>: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
EnablePurgeProtection bool: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
EnableRbacAuthorization bool: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
EnableSoftDelete bool: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
EnabledForDeployment bool: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
EnabledForDiskEncryption bool: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
EnabledForTemplateDeployment bool: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
NetworkAcls Pulumi.AzureNative.KeyVault.Inputs.NetworkRuleSetResponse: Rules governing the accessibility of the key vault from specific network locations.
ProvisioningState string: Provisioning state of the vault.
PublicNetworkAccess string: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
SoftDeleteRetentionInDays int: softDelete data retention days. It accepts >=7 and <=90.
VaultUri string: The URI of the vault for performing operations on keys and secrets.

HsmPoolResourceId string: The resource id of HSM Pool.
PrivateEndpointConnections []PrivateEndpointConnectionItemResponse: List of private endpoint connections associated with the key vault.
Sku SkuResponse: SKU details
TenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
AccessPolicies []AccessPolicyEntryResponse: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
EnablePurgeProtection bool: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
EnableRbacAuthorization bool: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
EnableSoftDelete bool: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
EnabledForDeployment bool: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
EnabledForDiskEncryption bool: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
EnabledForTemplateDeployment bool: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
NetworkAcls NetworkRuleSetResponse: Rules governing the accessibility of the key vault from specific network locations.
ProvisioningState string: Provisioning state of the vault.
PublicNetworkAccess string: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
SoftDeleteRetentionInDays int: softDelete data retention days. It accepts >=7 and <=90.
VaultUri string: The URI of the vault for performing operations on keys and secrets.

hsmPoolResourceId String: The resource id of HSM Pool.
privateEndpointConnections List<PrivateEndpointConnectionItemResponse>: List of private endpoint connections associated with the key vault.
sku SkuResponse: SKU details
tenantId String: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
accessPolicies List<AccessPolicyEntryResponse>: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
enablePurgeProtection Boolean: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enableRbacAuthorization Boolean: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enableSoftDelete Boolean: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
enabledForDeployment Boolean: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabledForDiskEncryption Boolean: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabledForTemplateDeployment Boolean: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
networkAcls NetworkRuleSetResponse: Rules governing the accessibility of the key vault from specific network locations.
provisioningState String: Provisioning state of the vault.
publicNetworkAccess String: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
softDeleteRetentionInDays Integer: softDelete data retention days. It accepts >=7 and <=90.
vaultUri String: The URI of the vault for performing operations on keys and secrets.

hsmPoolResourceId string: The resource id of HSM Pool.
privateEndpointConnections PrivateEndpointConnectionItemResponse[]: List of private endpoint connections associated with the key vault.
sku SkuResponse: SKU details
tenantId string: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
accessPolicies AccessPolicyEntryResponse[]: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
enablePurgeProtection boolean: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enableRbacAuthorization boolean: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enableSoftDelete boolean: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
enabledForDeployment boolean: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabledForDiskEncryption boolean: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabledForTemplateDeployment boolean: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
networkAcls NetworkRuleSetResponse: Rules governing the accessibility of the key vault from specific network locations.
provisioningState string: Provisioning state of the vault.
publicNetworkAccess string: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
softDeleteRetentionInDays number: softDelete data retention days. It accepts >=7 and <=90.
vaultUri string: The URI of the vault for performing operations on keys and secrets.

hsm_pool_resource_id str: The resource id of HSM Pool.
private_endpoint_connections Sequence[PrivateEndpointConnectionItemResponse]: List of private endpoint connections associated with the key vault.
sku SkuResponse: SKU details
tenant_id str: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
access_policies Sequence[AccessPolicyEntryResponse]: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
enable_purge_protection bool: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enable_rbac_authorization bool: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enable_soft_delete bool: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
enabled_for_deployment bool: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabled_for_disk_encryption bool: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabled_for_template_deployment bool: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
network_acls NetworkRuleSetResponse: Rules governing the accessibility of the key vault from specific network locations.
provisioning_state str: Provisioning state of the vault.
public_network_access str: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
soft_delete_retention_in_days int: softDelete data retention days. It accepts >=7 and <=90.
vault_uri str: The URI of the vault for performing operations on keys and secrets.

hsmPoolResourceId String: The resource id of HSM Pool.
privateEndpointConnections List<Property Map>: List of private endpoint connections associated with the key vault.
sku Property Map: SKU details
tenantId String: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
accessPolicies List<Property Map>: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required. These are also available as standalone resources. Do not mix inline and standalone resource as they will conflict with each other, leading to resources deletion.
enablePurgeProtection Boolean: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enableRbacAuthorization Boolean: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enableSoftDelete Boolean: Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
enabledForDeployment Boolean: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabledForDiskEncryption Boolean: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabledForTemplateDeployment Boolean: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
networkAcls Property Map: Rules governing the accessibility of the key vault from specific network locations.
provisioningState String: Provisioning state of the vault.
publicNetworkAccess String: Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
softDeleteRetentionInDays Number: softDelete data retention days. It accepts >=7 and <=90.
vaultUri String: The URI of the vault for performing operations on keys and secrets.

VaultProvisioningState, VaultProvisioningStateArgs

Succeeded: Succeeded
RegisteringDns: RegisteringDns

VaultProvisioningStateSucceeded: Succeeded
VaultProvisioningStateRegisteringDns: RegisteringDns

Succeeded: Succeeded
RegisteringDns: RegisteringDns

Succeeded: Succeeded
RegisteringDns: RegisteringDns

SUCCEEDED: Succeeded
REGISTERING_DNS: RegisteringDns

"Succeeded": Succeeded
"RegisteringDns": RegisteringDns

VirtualNetworkRule, VirtualNetworkRuleArgs

Id string: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
IgnoreMissingVnetServiceEndpoint bool: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

Id string: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
IgnoreMissingVnetServiceEndpoint bool: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

id String: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
ignoreMissingVnetServiceEndpoint Boolean: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

id string: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
ignoreMissingVnetServiceEndpoint boolean: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

id str: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
ignore_missing_vnet_service_endpoint bool: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

id String: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
ignoreMissingVnetServiceEndpoint Boolean: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

VirtualNetworkRuleResponse, VirtualNetworkRuleResponseArgs

Id string: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
IgnoreMissingVnetServiceEndpoint bool: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

Id string: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
IgnoreMissingVnetServiceEndpoint bool: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

id String: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
ignoreMissingVnetServiceEndpoint Boolean: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

id string: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
ignoreMissingVnetServiceEndpoint boolean: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

id str: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
ignore_missing_vnet_service_endpoint bool: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

id String: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
ignoreMissingVnetServiceEndpoint Boolean: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

Import

An existing resource can be imported using its type token, name, and identifier, e.g.

$ pulumi import azure-native:keyvault:Vault sample-vault /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository: Azure Native pulumi/pulumi-azure-native
License: Apache-2.0

This is the latest version of Azure Native. Use the Azure Native v1 docs if using the v1 version of this package.

Azure Native v2.63.0 published on Tuesday, Sep 24, 2024 by Pulumi

pulumi/pulumi-azure-native

azure-native.keyvault.Vault

On this page

On this page

Example Usage

Create a new vault or update an existing vault

Create or update a vault with network acls

Create Vault Resource

Constructor syntax

Parameters

Constructor example

Vault Resource Properties

Inputs

Outputs

Supporting Types

AccessPolicyEntry, AccessPolicyEntryArgs

AccessPolicyEntryResponse, AccessPolicyEntryResponseArgs

CertificatePermissions, CertificatePermissionsArgs

CreateMode, CreateModeArgs

IPRule, IPRuleArgs

IPRuleResponse, IPRuleResponseArgs

KeyPermissions, KeyPermissionsArgs

NetworkRuleAction, NetworkRuleActionArgs

NetworkRuleBypassOptions, NetworkRuleBypassOptionsArgs

NetworkRuleSet, NetworkRuleSetArgs

NetworkRuleSetResponse, NetworkRuleSetResponseArgs

Permissions, PermissionsArgs

PermissionsResponse, PermissionsResponseArgs

PrivateEndpointConnectionItemResponse, PrivateEndpointConnectionItemResponseArgs

PrivateEndpointResponse, PrivateEndpointResponseArgs

PrivateLinkServiceConnectionStateResponse, PrivateLinkServiceConnectionStateResponseArgs

SecretPermissions, SecretPermissionsArgs

Sku, SkuArgs

SkuFamily, SkuFamilyArgs

SkuName, SkuNameArgs

SkuResponse, SkuResponseArgs

StoragePermissions, StoragePermissionsArgs

SystemDataResponse, SystemDataResponseArgs

VaultProperties, VaultPropertiesArgs

VaultPropertiesResponse, VaultPropertiesResponseArgs

VaultProvisioningState, VaultProvisioningStateArgs

VirtualNetworkRule, VirtualNetworkRuleArgs

VirtualNetworkRuleResponse, VirtualNetworkRuleResponseArgs

Import

Package Details

On this page

On this page