HashiCorp Vault v6.6.0, Mar 13 25

HashiCorp Vault v6.6.0 published on Thursday, Mar 13, 2025 by Pulumi

vault.getPolicyDocument

Explore with Pulumi AI

HashiCorp Vault v6.6.0 published on Thursday, Mar 13, 2025 by Pulumi

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const example = vault.getPolicyDocument({
    rules: [{
        path: "secret/*",
        capabilities: [
            "create",
            "read",
            "update",
            "delete",
            "list",
        ],
        description: "allow all on secrets",
    }],
});
const examplePolicy = new vault.Policy("example", {
    name: "example_policy",
    policy: example.then(example => example.hcl),
});

import pulumi
import pulumi_vault as vault

example = vault.get_policy_document(rules=[{
    "path": "secret/*",
    "capabilities": [
        "create",
        "read",
        "update",
        "delete",
        "list",
    ],
    "description": "allow all on secrets",
}])
example_policy = vault.Policy("example",
    name="example_policy",
    policy=example.hcl)

package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := vault.GetPolicyDocument(ctx, &vault.GetPolicyDocumentArgs{
			Rules: []vault.GetPolicyDocumentRule{
				{
					Path: "secret/*",
					Capabilities: []string{
						"create",
						"read",
						"update",
						"delete",
						"list",
					},
					Description: pulumi.StringRef("allow all on secrets"),
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = vault.NewPolicy(ctx, "example", &vault.PolicyArgs{
			Name:   pulumi.String("example_policy"),
			Policy: pulumi.String(example.Hcl),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var example = Vault.GetPolicyDocument.Invoke(new()
    {
        Rules = new[]
        {
            new Vault.Inputs.GetPolicyDocumentRuleInputArgs
            {
                Path = "secret/*",
                Capabilities = new[]
                {
                    "create",
                    "read",
                    "update",
                    "delete",
                    "list",
                },
                Description = "allow all on secrets",
            },
        },
    });

    var examplePolicy = new Vault.Policy("example", new()
    {
        Name = "example_policy",
        PolicyContents = example.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Hcl),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.VaultFunctions;
import com.pulumi.vault.inputs.GetPolicyDocumentArgs;
import com.pulumi.vault.Policy;
import com.pulumi.vault.PolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = VaultFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .rules(GetPolicyDocumentRuleArgs.builder()
                .path("secret/*")
                .capabilities(                
                    "create",
                    "read",
                    "update",
                    "delete",
                    "list")
                .description("allow all on secrets")
                .build())
            .build());

        var examplePolicy = new Policy("examplePolicy", PolicyArgs.builder()
            .name("example_policy")
            .policy(example.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.hcl()))
            .build());

    }
}

resources:
  examplePolicy:
    type: vault:Policy
    name: example
    properties:
      name: example_policy
      policy: ${example.hcl}
variables:
  example:
    fn::invoke:
      function: vault:getPolicyDocument
      arguments:
        rules:
          - path: secret/*
            capabilities:
              - create
              - read
              - update
              - delete
              - list
            description: allow all on secrets

Using getPolicyDocument

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getPolicyDocument(args: GetPolicyDocumentArgs, opts?: InvokeOptions): Promise<GetPolicyDocumentResult>
function getPolicyDocumentOutput(args: GetPolicyDocumentOutputArgs, opts?: InvokeOptions): Output<GetPolicyDocumentResult>

def get_policy_document(namespace: Optional[str] = None,
                        rules: Optional[Sequence[GetPolicyDocumentRule]] = None,
                        opts: Optional[InvokeOptions] = None) -> GetPolicyDocumentResult
def get_policy_document_output(namespace: Optional[pulumi.Input[str]] = None,
                        rules: Optional[pulumi.Input[Sequence[pulumi.Input[GetPolicyDocumentRuleArgs]]]] = None,
                        opts: Optional[InvokeOptions] = None) -> Output[GetPolicyDocumentResult]

func GetPolicyDocument(ctx *Context, args *GetPolicyDocumentArgs, opts ...InvokeOption) (*GetPolicyDocumentResult, error)
func GetPolicyDocumentOutput(ctx *Context, args *GetPolicyDocumentOutputArgs, opts ...InvokeOption) GetPolicyDocumentResultOutput

> Note: This function is named GetPolicyDocument in the Go SDK.

public static class GetPolicyDocument 
{
    public static Task<GetPolicyDocumentResult> InvokeAsync(GetPolicyDocumentArgs args, InvokeOptions? opts = null)
    public static Output<GetPolicyDocumentResult> Invoke(GetPolicyDocumentInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetPolicyDocumentResult> getPolicyDocument(GetPolicyDocumentArgs args, InvokeOptions options)
public static Output<GetPolicyDocumentResult> getPolicyDocument(GetPolicyDocumentArgs args, InvokeOptions options)

fn::invoke:
  function: vault:index/getPolicyDocument:getPolicyDocument
  arguments:
    # arguments dictionary

The following arguments are supported:

Namespace string
Rules List<GetPolicyDocumentRule>

Namespace string
Rules []GetPolicyDocumentRule

namespace String
rules List<GetPolicyDocumentRule>

namespace string
rules GetPolicyDocumentRule[]

namespace str
rules Sequence[GetPolicyDocumentRule]

namespace String
rules List<Property Map>

getPolicyDocument Result

The following output properties are available:

Hcl string: The above arguments serialized as a standard Vault HCL policy document.
Id string: The provider-assigned unique ID for this managed resource.
Rules List<GetPolicyDocumentRule>
Namespace string

Hcl string: The above arguments serialized as a standard Vault HCL policy document.
Id string: The provider-assigned unique ID for this managed resource.
Rules []GetPolicyDocumentRule
Namespace string

hcl String: The above arguments serialized as a standard Vault HCL policy document.
id String: The provider-assigned unique ID for this managed resource.
rules List<GetPolicyDocumentRule>
namespace String

hcl string: The above arguments serialized as a standard Vault HCL policy document.
id string: The provider-assigned unique ID for this managed resource.
rules GetPolicyDocumentRule[]
namespace string

hcl str: The above arguments serialized as a standard Vault HCL policy document.
id str: The provider-assigned unique ID for this managed resource.
rules Sequence[GetPolicyDocumentRule]
namespace str

hcl String: The above arguments serialized as a standard Vault HCL policy document.
id String: The provider-assigned unique ID for this managed resource.
rules List<Property Map>
namespace String

Supporting Types

GetPolicyDocumentRule

Capabilities List<string>: A list of capabilities that this rule apply to path. For example, ["read", "write"].
Path string: A path in Vault that this rule applies to.
AllowedParameters List<GetPolicyDocumentRuleAllowedParameter>: Whitelists a list of keys and values that are permitted on the given path. See Parameters below.
DeniedParameters List<GetPolicyDocumentRuleDeniedParameter>: Blacklists a list of parameter and values. Any values specified here take precedence over allowed_parameter. See Parameters below.
Description string: Description of the rule. Will be added as a comment to rendered rule.
MaxWrappingTtl string: The maximum allowed TTL that clients can specify for a wrapped response.
MinWrappingTtl string: The minimum allowed TTL that clients can specify for a wrapped response.
RequiredParameters List<string>: A list of parameters that must be specified.

Capabilities []string: A list of capabilities that this rule apply to path. For example, ["read", "write"].
Path string: A path in Vault that this rule applies to.
AllowedParameters []GetPolicyDocumentRuleAllowedParameter: Whitelists a list of keys and values that are permitted on the given path. See Parameters below.
DeniedParameters []GetPolicyDocumentRuleDeniedParameter: Blacklists a list of parameter and values. Any values specified here take precedence over allowed_parameter. See Parameters below.
Description string: Description of the rule. Will be added as a comment to rendered rule.
MaxWrappingTtl string: The maximum allowed TTL that clients can specify for a wrapped response.
MinWrappingTtl string: The minimum allowed TTL that clients can specify for a wrapped response.
RequiredParameters []string: A list of parameters that must be specified.

capabilities List<String>: A list of capabilities that this rule apply to path. For example, ["read", "write"].
path String: A path in Vault that this rule applies to.
allowedParameters List<GetPolicyDocumentRuleAllowedParameter>: Whitelists a list of keys and values that are permitted on the given path. See Parameters below.
deniedParameters List<GetPolicyDocumentRuleDeniedParameter>: Blacklists a list of parameter and values. Any values specified here take precedence over allowed_parameter. See Parameters below.
description String: Description of the rule. Will be added as a comment to rendered rule.
maxWrappingTtl String: The maximum allowed TTL that clients can specify for a wrapped response.
minWrappingTtl String: The minimum allowed TTL that clients can specify for a wrapped response.
requiredParameters List<String>: A list of parameters that must be specified.

capabilities string[]: A list of capabilities that this rule apply to path. For example, ["read", "write"].
path string: A path in Vault that this rule applies to.
allowedParameters GetPolicyDocumentRuleAllowedParameter[]: Whitelists a list of keys and values that are permitted on the given path. See Parameters below.
deniedParameters GetPolicyDocumentRuleDeniedParameter[]: Blacklists a list of parameter and values. Any values specified here take precedence over allowed_parameter. See Parameters below.
description string: Description of the rule. Will be added as a comment to rendered rule.
maxWrappingTtl string: The maximum allowed TTL that clients can specify for a wrapped response.
minWrappingTtl string: The minimum allowed TTL that clients can specify for a wrapped response.
requiredParameters string[]: A list of parameters that must be specified.

capabilities Sequence[str]: A list of capabilities that this rule apply to path. For example, ["read", "write"].
path str: A path in Vault that this rule applies to.
allowed_parameters Sequence[GetPolicyDocumentRuleAllowedParameter]: Whitelists a list of keys and values that are permitted on the given path. See Parameters below.
denied_parameters Sequence[GetPolicyDocumentRuleDeniedParameter]: Blacklists a list of parameter and values. Any values specified here take precedence over allowed_parameter. See Parameters below.
description str: Description of the rule. Will be added as a comment to rendered rule.
max_wrapping_ttl str: The maximum allowed TTL that clients can specify for a wrapped response.
min_wrapping_ttl str: The minimum allowed TTL that clients can specify for a wrapped response.
required_parameters Sequence[str]: A list of parameters that must be specified.

capabilities List<String>: A list of capabilities that this rule apply to path. For example, ["read", "write"].
path String: A path in Vault that this rule applies to.
allowedParameters List<Property Map>: Whitelists a list of keys and values that are permitted on the given path. See Parameters below.
deniedParameters List<Property Map>: Blacklists a list of parameter and values. Any values specified here take precedence over allowed_parameter. See Parameters below.
description String: Description of the rule. Will be added as a comment to rendered rule.
maxWrappingTtl String: The maximum allowed TTL that clients can specify for a wrapped response.
minWrappingTtl String: The minimum allowed TTL that clients can specify for a wrapped response.
requiredParameters List<String>: A list of parameters that must be specified.

GetPolicyDocumentRuleAllowedParameter

Key string: name of permitted or denied parameter.
Values List<string>: list of values what are permitted or denied by policy rule.

Key string: name of permitted or denied parameter.
Values []string: list of values what are permitted or denied by policy rule.

key String: name of permitted or denied parameter.
values List<String>: list of values what are permitted or denied by policy rule.

key string: name of permitted or denied parameter.
values string[]: list of values what are permitted or denied by policy rule.

key str: name of permitted or denied parameter.
values Sequence[str]: list of values what are permitted or denied by policy rule.

key String: name of permitted or denied parameter.
values List<String>: list of values what are permitted or denied by policy rule.

GetPolicyDocumentRuleDeniedParameter

Key string: name of permitted or denied parameter.
Values List<string>: list of values what are permitted or denied by policy rule.

Key string: name of permitted or denied parameter.
Values []string: list of values what are permitted or denied by policy rule.

key String: name of permitted or denied parameter.
values List<String>: list of values what are permitted or denied by policy rule.

key string: name of permitted or denied parameter.
values string[]: list of values what are permitted or denied by policy rule.

key str: name of permitted or denied parameter.
values Sequence[str]: list of values what are permitted or denied by policy rule.

key String: name of permitted or denied parameter.
values List<String>: list of values what are permitted or denied by policy rule.

Package Details

Repository: Vault pulumi/pulumi-vault
License: Apache-2.0
Notes: This Pulumi package is based on the vault Terraform Provider.

HashiCorp Vault v6.6.0 published on Thursday, Mar 13, 2025 by Pulumi

pulumi/pulumi-vault

vault.getPolicyDocument

On this page

On this page

Example Usage

Using getPolicyDocument

getPolicyDocument Result

Supporting Types

GetPolicyDocumentRule

GetPolicyDocumentRuleAllowedParameter

GetPolicyDocumentRuleDeniedParameter

Package Details

On this page

On this page