Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. HashiCorp Vault Provider
  3. API Docs
  4. gcp
  5. SecretImpersonatedAccount
HashiCorp Vault v6.7.1 published on Friday, May 2, 2025 by Pulumi
pulumi/pulumi-vault

vault.gcp.SecretImpersonatedAccount

Explore with Pulumi AI

vault logo
HashiCorp Vault v6.7.1 published on Friday, May 2, 2025 by Pulumi
pulumi/pulumi-vault

    Creates a Impersonated Account in the GCP Secrets Engine for Vault.

    Each impersonated account is tied to a separately managed Service Account.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as google from "@pulumi/google";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const _this = new google.index.ServiceAccount("this", {accountId: "my-awesome-account"});
const gcp = new vault.gcp.SecretBackend("gcp", {
    path: "gcp",
    credentials: std.file({
        input: "credentials.json",
    }).then(invoke => invoke.result),
});
const impersonatedAccount = new vault.gcp.SecretImpersonatedAccount("impersonated_account", {
    backend: gcp.path,
    impersonatedAccount: "this",
    serviceAccountEmail: _this.email,
    tokenScopes: ["https://www.googleapis.com/auth/cloud-platform"],
});

    import pulumi
import pulumi_google as google
import pulumi_std as std
import pulumi_vault as vault

this = google.index.ServiceAccount("this", account_id=my-awesome-account)
gcp = vault.gcp.SecretBackend("gcp",
    path="gcp",
    credentials=std.file(input="credentials.json").result)
impersonated_account = vault.gcp.SecretImpersonatedAccount("impersonated_account",
    backend=gcp.path,
    impersonated_account="this",
    service_account_email=this["email"],
    token_scopes=["https://www.googleapis.com/auth/cloud-platform"])

    package main

import (
	"github.com/pulumi/pulumi-google/sdk/go/google"
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/gcp"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		this, err := google.NewServiceAccount(ctx, "this", &google.ServiceAccountArgs{
			AccountId: "my-awesome-account",
		})
		if err != nil {
			return err
		}
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "credentials.json",
		}, nil)
		if err != nil {
			return err
		}
		gcp, err := gcp.NewSecretBackend(ctx, "gcp", &gcp.SecretBackendArgs{
			Path:        pulumi.String("gcp"),
			Credentials: pulumi.String(invokeFile.Result),
		})
		if err != nil {
			return err
		}
		_, err = gcp.NewSecretImpersonatedAccount(ctx, "impersonated_account", &gcp.SecretImpersonatedAccountArgs{
			Backend:             gcp.Path,
			ImpersonatedAccount: pulumi.String("this"),
			ServiceAccountEmail: this.Email,
			TokenScopes: pulumi.StringArray{
				pulumi.String("https://www.googleapis.com/auth/cloud-platform"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Google = Pulumi.Google;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var @this = new Google.Index.ServiceAccount("this", new()
    {
        AccountId = "my-awesome-account",
    });

    var gcp = new Vault.Gcp.SecretBackend("gcp", new()
    {
        Path = "gcp",
        Credentials = Std.File.Invoke(new()
        {
            Input = "credentials.json",
        }).Apply(invoke => invoke.Result),
    });

    var impersonatedAccount = new Vault.Gcp.SecretImpersonatedAccount("impersonated_account", new()
    {
        Backend = gcp.Path,
        ImpersonatedAccount = "this",
        ServiceAccountEmail = @this.Email,
        TokenScopes = new[]
        {
            "https://www.googleapis.com/auth/cloud-platform",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.google.serviceAccount;
import com.pulumi.google.serviceAccountArgs;
import com.pulumi.vault.gcp.SecretBackend;
import com.pulumi.vault.gcp.SecretBackendArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import com.pulumi.vault.gcp.SecretImpersonatedAccount;
import com.pulumi.vault.gcp.SecretImpersonatedAccountArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var this_ = new ServiceAccount("this", ServiceAccountArgs.builder()
            .accountId("my-awesome-account")
            .build());

        var gcp = new SecretBackend("gcp", SecretBackendArgs.builder()
            .path("gcp")
            .credentials(StdFunctions.file(FileArgs.builder()
                .input("credentials.json")
                .build()).result())
            .build());

        var impersonatedAccount = new SecretImpersonatedAccount("impersonatedAccount", SecretImpersonatedAccountArgs.builder()
            .backend(gcp.path())
            .impersonatedAccount("this")
            .serviceAccountEmail(this_.email())
            .tokenScopes("https://www.googleapis.com/auth/cloud-platform")
            .build());

    }
}

    resources:
  this:
    type: google:serviceAccount
    properties:
      accountId: my-awesome-account
  gcp:
    type: vault:gcp:SecretBackend
    properties:
      path: gcp
      credentials:
        fn::invoke:
          function: std:file
          arguments:
            input: credentials.json
          return: result
  impersonatedAccount:
    type: vault:gcp:SecretImpersonatedAccount
    name: impersonated_account
    properties:
      backend: ${gcp.path}
      impersonatedAccount: this
      serviceAccountEmail: ${this.email}
      tokenScopes:
        - https://www.googleapis.com/auth/cloud-platform

    Create SecretImpersonatedAccount Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretImpersonatedAccount(name: string, args: SecretImpersonatedAccountArgs, opts?: CustomResourceOptions);
    @overload
def SecretImpersonatedAccount(resource_name: str,
                              args: SecretImpersonatedAccountArgs,
                              opts: Optional[ResourceOptions] = None)

@overload
def SecretImpersonatedAccount(resource_name: str,
                              opts: Optional[ResourceOptions] = None,
                              backend: Optional[str] = None,
                              impersonated_account: Optional[str] = None,
                              service_account_email: Optional[str] = None,
                              namespace: Optional[str] = None,
                              token_scopes: Optional[Sequence[str]] = None,
                              ttl: Optional[str] = None)
    func NewSecretImpersonatedAccount(ctx *Context, name string, args SecretImpersonatedAccountArgs, opts ...ResourceOption) (*SecretImpersonatedAccount, error)
    public SecretImpersonatedAccount(string name, SecretImpersonatedAccountArgs args, CustomResourceOptions? opts = null)
    public SecretImpersonatedAccount(String name, SecretImpersonatedAccountArgs args)
public SecretImpersonatedAccount(String name, SecretImpersonatedAccountArgs args, CustomResourceOptions options)

    type: vault:gcp:SecretImpersonatedAccount
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args SecretImpersonatedAccountArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretImpersonatedAccountArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretImpersonatedAccountArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretImpersonatedAccountArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretImpersonatedAccountArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretImpersonatedAccountResource = new Vault.Gcp.SecretImpersonatedAccount("secretImpersonatedAccountResource", new()
{
    Backend = "string",
    ImpersonatedAccount = "string",
    ServiceAccountEmail = "string",
    Namespace = "string",
    TokenScopes = new[]
    {
        "string",
    },
    Ttl = "string",
});

    example, err := gcp.NewSecretImpersonatedAccount(ctx, "secretImpersonatedAccountResource", &gcp.SecretImpersonatedAccountArgs{
	Backend:             pulumi.String("string"),
	ImpersonatedAccount: pulumi.String("string"),
	ServiceAccountEmail: pulumi.String("string"),
	Namespace:           pulumi.String("string"),
	TokenScopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	Ttl: pulumi.String("string"),
})

    var secretImpersonatedAccountResource = new SecretImpersonatedAccount("secretImpersonatedAccountResource", SecretImpersonatedAccountArgs.builder()
    .backend("string")
    .impersonatedAccount("string")
    .serviceAccountEmail("string")
    .namespace("string")
    .tokenScopes("string")
    .ttl("string")
    .build());

    secret_impersonated_account_resource = vault.gcp.SecretImpersonatedAccount("secretImpersonatedAccountResource",
    backend="string",
    impersonated_account="string",
    service_account_email="string",
    namespace="string",
    token_scopes=["string"],
    ttl="string")

    const secretImpersonatedAccountResource = new vault.gcp.SecretImpersonatedAccount("secretImpersonatedAccountResource", {
    backend: "string",
    impersonatedAccount: "string",
    serviceAccountEmail: "string",
    namespace: "string",
    tokenScopes: ["string"],
    ttl: "string",
});

    type: vault:gcp:SecretImpersonatedAccount
properties:
    backend: string
    impersonatedAccount: string
    namespace: string
    serviceAccountEmail: string
    tokenScopes:
        - string
    ttl: string

    SecretImpersonatedAccount Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretImpersonatedAccount resource accepts the following input properties:

    Backend string
    Path where the GCP Secrets Engine is mounted
    ImpersonatedAccount string
    Name of the Impersonated Account to create
    ServiceAccountEmail string
    Email of the GCP service account to impersonate.
    Namespace string
    Target namespace. (requires Enterprise)
    TokenScopes List<string>
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    Ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    Backend string
    Path where the GCP Secrets Engine is mounted
    ImpersonatedAccount string
    Name of the Impersonated Account to create
    ServiceAccountEmail string
    Email of the GCP service account to impersonate.
    Namespace string
    Target namespace. (requires Enterprise)
    TokenScopes []string
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    Ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    backend String
    Path where the GCP Secrets Engine is mounted
    impersonatedAccount String
    Name of the Impersonated Account to create
    serviceAccountEmail String
    Email of the GCP service account to impersonate.
    namespace String
    Target namespace. (requires Enterprise)
    tokenScopes List<String>
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    ttl String
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    backend string
    Path where the GCP Secrets Engine is mounted
    impersonatedAccount string
    Name of the Impersonated Account to create
    serviceAccountEmail string
    Email of the GCP service account to impersonate.
    namespace string
    Target namespace. (requires Enterprise)
    tokenScopes string[]
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    backend str
    Path where the GCP Secrets Engine is mounted
    impersonated_account str
    Name of the Impersonated Account to create
    service_account_email str
    Email of the GCP service account to impersonate.
    namespace str
    Target namespace. (requires Enterprise)
    token_scopes Sequence[str]
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    ttl str
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    backend String
    Path where the GCP Secrets Engine is mounted
    impersonatedAccount String
    Name of the Impersonated Account to create
    serviceAccountEmail String
    Email of the GCP service account to impersonate.
    namespace String
    Target namespace. (requires Enterprise)
    tokenScopes List<String>
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    ttl String
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretImpersonatedAccount resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    ServiceAccountProject string
    Project the service account belongs to.
    Id string
    The provider-assigned unique ID for this managed resource.
    ServiceAccountProject string
    Project the service account belongs to.
    id String
    The provider-assigned unique ID for this managed resource.
    serviceAccountProject String
    Project the service account belongs to.
    id string
    The provider-assigned unique ID for this managed resource.
    serviceAccountProject string
    Project the service account belongs to.
    id str
    The provider-assigned unique ID for this managed resource.
    service_account_project str
    Project the service account belongs to.
    id String
    The provider-assigned unique ID for this managed resource.
    serviceAccountProject String
    Project the service account belongs to.

    Look up Existing SecretImpersonatedAccount Resource

    Get an existing SecretImpersonatedAccount resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretImpersonatedAccountState, opts?: CustomResourceOptions): SecretImpersonatedAccount
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        backend: Optional[str] = None,
        impersonated_account: Optional[str] = None,
        namespace: Optional[str] = None,
        service_account_email: Optional[str] = None,
        service_account_project: Optional[str] = None,
        token_scopes: Optional[Sequence[str]] = None,
        ttl: Optional[str] = None) -> SecretImpersonatedAccount
    func GetSecretImpersonatedAccount(ctx *Context, name string, id IDInput, state *SecretImpersonatedAccountState, opts ...ResourceOption) (*SecretImpersonatedAccount, error)
    public static SecretImpersonatedAccount Get(string name, Input<string> id, SecretImpersonatedAccountState? state, CustomResourceOptions? opts = null)
    public static SecretImpersonatedAccount get(String name, Output<String> id, SecretImpersonatedAccountState state, CustomResourceOptions options)
    resources:  _:    type: vault:gcp:SecretImpersonatedAccount    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Backend string
    Path where the GCP Secrets Engine is mounted
    ImpersonatedAccount string
    Name of the Impersonated Account to create
    Namespace string
    Target namespace. (requires Enterprise)
    ServiceAccountEmail string
    Email of the GCP service account to impersonate.
    ServiceAccountProject string
    Project the service account belongs to.
    TokenScopes List<string>
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    Ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    Backend string
    Path where the GCP Secrets Engine is mounted
    ImpersonatedAccount string
    Name of the Impersonated Account to create
    Namespace string
    Target namespace. (requires Enterprise)
    ServiceAccountEmail string
    Email of the GCP service account to impersonate.
    ServiceAccountProject string
    Project the service account belongs to.
    TokenScopes []string
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    Ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    backend String
    Path where the GCP Secrets Engine is mounted
    impersonatedAccount String
    Name of the Impersonated Account to create
    namespace String
    Target namespace. (requires Enterprise)
    serviceAccountEmail String
    Email of the GCP service account to impersonate.
    serviceAccountProject String
    Project the service account belongs to.
    tokenScopes List<String>
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    ttl String
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    backend string
    Path where the GCP Secrets Engine is mounted
    impersonatedAccount string
    Name of the Impersonated Account to create
    namespace string
    Target namespace. (requires Enterprise)
    serviceAccountEmail string
    Email of the GCP service account to impersonate.
    serviceAccountProject string
    Project the service account belongs to.
    tokenScopes string[]
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    ttl string
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    backend str
    Path where the GCP Secrets Engine is mounted
    impersonated_account str
    Name of the Impersonated Account to create
    namespace str
    Target namespace. (requires Enterprise)
    service_account_email str
    Email of the GCP service account to impersonate.
    service_account_project str
    Project the service account belongs to.
    token_scopes Sequence[str]
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    ttl str
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
    backend String
    Path where the GCP Secrets Engine is mounted
    impersonatedAccount String
    Name of the Impersonated Account to create
    namespace String
    Target namespace. (requires Enterprise)
    serviceAccountEmail String
    Email of the GCP service account to impersonate.
    serviceAccountProject String
    Project the service account belongs to.
    tokenScopes List<String>
    List of OAuth scopes to assign to access tokens generated under this impersonated account.
    ttl String
    Specifies the default TTL for service principals generated using this role. Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.

    Import

    A impersonated account can be imported using its Vault Path. For example, referencing the example above,

    $ pulumi import vault:gcp/secretImpersonatedAccount:SecretImpersonatedAccount impersonated_account gcp/impersonated-account/project_viewer

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo
    HashiCorp Vault v6.7.1 published on Friday, May 2, 2025 by Pulumi
    pulumi/pulumi-vault