Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. HashiCorp Vault Provider
  3. API Docs
  4. gcp
  5. SecretStaticAccount
HashiCorp Vault v6.7.1 published on Friday, May 2, 2025 by Pulumi
pulumi/pulumi-vault

vault.gcp.SecretStaticAccount

Explore with Pulumi AI

vault logo
HashiCorp Vault v6.7.1 published on Friday, May 2, 2025 by Pulumi
pulumi/pulumi-vault

    Creates a Static Account in the GCP Secrets Engine for Vault.

    Each static account is tied to a separately managed Service Account, and can have one or more bindings associated with it.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as google from "@pulumi/google";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const _this = new google.index.ServiceAccount("this", {accountId: "my-awesome-account"});
const gcp = new vault.gcp.SecretBackend("gcp", {
    path: "gcp",
    credentials: std.file({
        input: "credentials.json",
    }).then(invoke => invoke.result),
});
const staticAccount = new vault.gcp.SecretStaticAccount("static_account", {
    backend: gcp.path,
    staticAccount: "project_viewer",
    secretType: "access_token",
    tokenScopes: ["https://www.googleapis.com/auth/cloud-platform"],
    serviceAccountEmail: _this.email,
    bindings: [{
        resource: `//cloudresourcemanager.googleapis.com/projects/${_this.project}`,
        roles: ["roles/viewer"],
    }],
});

    import pulumi
import pulumi_google as google
import pulumi_std as std
import pulumi_vault as vault

this = google.index.ServiceAccount("this", account_id=my-awesome-account)
gcp = vault.gcp.SecretBackend("gcp",
    path="gcp",
    credentials=std.file(input="credentials.json").result)
static_account = vault.gcp.SecretStaticAccount("static_account",
    backend=gcp.path,
    static_account="project_viewer",
    secret_type="access_token",
    token_scopes=["https://www.googleapis.com/auth/cloud-platform"],
    service_account_email=this["email"],
    bindings=[{
        "resource": f"//cloudresourcemanager.googleapis.com/projects/{this['project']}",
        "roles": ["roles/viewer"],
    }])

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-google/sdk/go/google"
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/gcp"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		this, err := google.NewServiceAccount(ctx, "this", &google.ServiceAccountArgs{
			AccountId: "my-awesome-account",
		})
		if err != nil {
			return err
		}
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "credentials.json",
		}, nil)
		if err != nil {
			return err
		}
		gcp, err := gcp.NewSecretBackend(ctx, "gcp", &gcp.SecretBackendArgs{
			Path:        pulumi.String("gcp"),
			Credentials: pulumi.String(invokeFile.Result),
		})
		if err != nil {
			return err
		}
		_, err = gcp.NewSecretStaticAccount(ctx, "static_account", &gcp.SecretStaticAccountArgs{
			Backend:       gcp.Path,
			StaticAccount: pulumi.String("project_viewer"),
			SecretType:    pulumi.String("access_token"),
			TokenScopes: pulumi.StringArray{
				pulumi.String("https://www.googleapis.com/auth/cloud-platform"),
			},
			ServiceAccountEmail: this.Email,
			Bindings: gcp.SecretStaticAccountBindingArray{
				&gcp.SecretStaticAccountBindingArgs{
					Resource: pulumi.Sprintf("//cloudresourcemanager.googleapis.com/projects/%v", this.Project),
					Roles: pulumi.StringArray{
						pulumi.String("roles/viewer"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Google = Pulumi.Google;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var @this = new Google.Index.ServiceAccount("this", new()
    {
        AccountId = "my-awesome-account",
    });

    var gcp = new Vault.Gcp.SecretBackend("gcp", new()
    {
        Path = "gcp",
        Credentials = Std.File.Invoke(new()
        {
            Input = "credentials.json",
        }).Apply(invoke => invoke.Result),
    });

    var staticAccount = new Vault.Gcp.SecretStaticAccount("static_account", new()
    {
        Backend = gcp.Path,
        StaticAccount = "project_viewer",
        SecretType = "access_token",
        TokenScopes = new[]
        {
            "https://www.googleapis.com/auth/cloud-platform",
        },
        ServiceAccountEmail = @this.Email,
        Bindings = new[]
        {
            new Vault.Gcp.Inputs.SecretStaticAccountBindingArgs
            {
                Resource = $"//cloudresourcemanager.googleapis.com/projects/{@this.Project}",
                Roles = new[]
                {
                    "roles/viewer",
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.google.serviceAccount;
import com.pulumi.google.serviceAccountArgs;
import com.pulumi.vault.gcp.SecretBackend;
import com.pulumi.vault.gcp.SecretBackendArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import com.pulumi.vault.gcp.SecretStaticAccount;
import com.pulumi.vault.gcp.SecretStaticAccountArgs;
import com.pulumi.vault.gcp.inputs.SecretStaticAccountBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var this_ = new ServiceAccount("this", ServiceAccountArgs.builder()
            .accountId("my-awesome-account")
            .build());

        var gcp = new SecretBackend("gcp", SecretBackendArgs.builder()
            .path("gcp")
            .credentials(StdFunctions.file(FileArgs.builder()
                .input("credentials.json")
                .build()).result())
            .build());

        var staticAccount = new SecretStaticAccount("staticAccount", SecretStaticAccountArgs.builder()
            .backend(gcp.path())
            .staticAccount("project_viewer")
            .secretType("access_token")
            .tokenScopes("https://www.googleapis.com/auth/cloud-platform")
            .serviceAccountEmail(this_.email())
            .bindings(SecretStaticAccountBindingArgs.builder()
                .resource(String.format("//cloudresourcemanager.googleapis.com/projects/%s", this_.project()))
                .roles("roles/viewer")
                .build())
            .build());

    }
}

    resources:
  this:
    type: google:serviceAccount
    properties:
      accountId: my-awesome-account
  gcp:
    type: vault:gcp:SecretBackend
    properties:
      path: gcp
      credentials:
        fn::invoke:
          function: std:file
          arguments:
            input: credentials.json
          return: result
  staticAccount:
    type: vault:gcp:SecretStaticAccount
    name: static_account
    properties:
      backend: ${gcp.path}
      staticAccount: project_viewer
      secretType: access_token
      tokenScopes:
        - https://www.googleapis.com/auth/cloud-platform
      serviceAccountEmail: ${this.email}
      bindings:
        - resource: //cloudresourcemanager.googleapis.com/projects/${this.project}
          roles:
            - roles/viewer

    Create SecretStaticAccount Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretStaticAccount(name: string, args: SecretStaticAccountArgs, opts?: CustomResourceOptions);
    @overload
def SecretStaticAccount(resource_name: str,
                        args: SecretStaticAccountArgs,
                        opts: Optional[ResourceOptions] = None)

@overload
def SecretStaticAccount(resource_name: str,
                        opts: Optional[ResourceOptions] = None,
                        backend: Optional[str] = None,
                        service_account_email: Optional[str] = None,
                        static_account: Optional[str] = None,
                        bindings: Optional[Sequence[SecretStaticAccountBindingArgs]] = None,
                        namespace: Optional[str] = None,
                        secret_type: Optional[str] = None,
                        token_scopes: Optional[Sequence[str]] = None)
    func NewSecretStaticAccount(ctx *Context, name string, args SecretStaticAccountArgs, opts ...ResourceOption) (*SecretStaticAccount, error)
    public SecretStaticAccount(string name, SecretStaticAccountArgs args, CustomResourceOptions? opts = null)
    public SecretStaticAccount(String name, SecretStaticAccountArgs args)
public SecretStaticAccount(String name, SecretStaticAccountArgs args, CustomResourceOptions options)

    type: vault:gcp:SecretStaticAccount
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args SecretStaticAccountArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretStaticAccountArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretStaticAccountArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretStaticAccountArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretStaticAccountArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretStaticAccountResource = new Vault.Gcp.SecretStaticAccount("secretStaticAccountResource", new()
{
    Backend = "string",
    ServiceAccountEmail = "string",
    StaticAccount = "string",
    Bindings = new[]
    {
        new Vault.Gcp.Inputs.SecretStaticAccountBindingArgs
        {
            Resource = "string",
            Roles = new[]
            {
                "string",
            },
        },
    },
    Namespace = "string",
    SecretType = "string",
    TokenScopes = new[]
    {
        "string",
    },
});

    example, err := gcp.NewSecretStaticAccount(ctx, "secretStaticAccountResource", &gcp.SecretStaticAccountArgs{
	Backend:             pulumi.String("string"),
	ServiceAccountEmail: pulumi.String("string"),
	StaticAccount:       pulumi.String("string"),
	Bindings: gcp.SecretStaticAccountBindingArray{
		&gcp.SecretStaticAccountBindingArgs{
			Resource: pulumi.String("string"),
			Roles: pulumi.StringArray{
				pulumi.String("string"),
			},
		},
	},
	Namespace:  pulumi.String("string"),
	SecretType: pulumi.String("string"),
	TokenScopes: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    var secretStaticAccountResource = new SecretStaticAccount("secretStaticAccountResource", SecretStaticAccountArgs.builder()
    .backend("string")
    .serviceAccountEmail("string")
    .staticAccount("string")
    .bindings(SecretStaticAccountBindingArgs.builder()
        .resource("string")
        .roles("string")
        .build())
    .namespace("string")
    .secretType("string")
    .tokenScopes("string")
    .build());

    secret_static_account_resource = vault.gcp.SecretStaticAccount("secretStaticAccountResource",
    backend="string",
    service_account_email="string",
    static_account="string",
    bindings=[{
        "resource": "string",
        "roles": ["string"],
    }],
    namespace="string",
    secret_type="string",
    token_scopes=["string"])

    const secretStaticAccountResource = new vault.gcp.SecretStaticAccount("secretStaticAccountResource", {
    backend: "string",
    serviceAccountEmail: "string",
    staticAccount: "string",
    bindings: [{
        resource: "string",
        roles: ["string"],
    }],
    namespace: "string",
    secretType: "string",
    tokenScopes: ["string"],
});

    type: vault:gcp:SecretStaticAccount
properties:
    backend: string
    bindings:
        - resource: string
          roles:
            - string
    namespace: string
    secretType: string
    serviceAccountEmail: string
    staticAccount: string
    tokenScopes:
        - string

    SecretStaticAccount Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretStaticAccount resource accepts the following input properties:

    Backend string
    Path where the GCP Secrets Engine is mounted
    ServiceAccountEmail string
    Email of the GCP service account to manage.
    StaticAccount string
    Name of the Static Account to create
    Bindings List<SecretStaticAccountBinding>
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    SecretType string
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    TokenScopes List<string>
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).
    Backend string
    Path where the GCP Secrets Engine is mounted
    ServiceAccountEmail string
    Email of the GCP service account to manage.
    StaticAccount string
    Name of the Static Account to create
    Bindings []SecretStaticAccountBindingArgs
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    SecretType string
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    TokenScopes []string
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).
    backend String
    Path where the GCP Secrets Engine is mounted
    serviceAccountEmail String
    Email of the GCP service account to manage.
    staticAccount String
    Name of the Static Account to create
    bindings List<SecretStaticAccountBinding>
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secretType String
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    tokenScopes List<String>
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).
    backend string
    Path where the GCP Secrets Engine is mounted
    serviceAccountEmail string
    Email of the GCP service account to manage.
    staticAccount string
    Name of the Static Account to create
    bindings SecretStaticAccountBinding[]
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secretType string
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    tokenScopes string[]
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).
    backend str
    Path where the GCP Secrets Engine is mounted
    service_account_email str
    Email of the GCP service account to manage.
    static_account str
    Name of the Static Account to create
    bindings Sequence[SecretStaticAccountBindingArgs]
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secret_type str
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    token_scopes Sequence[str]
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).
    backend String
    Path where the GCP Secrets Engine is mounted
    serviceAccountEmail String
    Email of the GCP service account to manage.
    staticAccount String
    Name of the Static Account to create
    bindings List<Property Map>
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secretType String
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    tokenScopes List<String>
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretStaticAccount resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    ServiceAccountProject string
    Project the service account belongs to.
    Id string
    The provider-assigned unique ID for this managed resource.
    ServiceAccountProject string
    Project the service account belongs to.
    id String
    The provider-assigned unique ID for this managed resource.
    serviceAccountProject String
    Project the service account belongs to.
    id string
    The provider-assigned unique ID for this managed resource.
    serviceAccountProject string
    Project the service account belongs to.
    id str
    The provider-assigned unique ID for this managed resource.
    service_account_project str
    Project the service account belongs to.
    id String
    The provider-assigned unique ID for this managed resource.
    serviceAccountProject String
    Project the service account belongs to.

    Look up Existing SecretStaticAccount Resource

    Get an existing SecretStaticAccount resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretStaticAccountState, opts?: CustomResourceOptions): SecretStaticAccount
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        backend: Optional[str] = None,
        bindings: Optional[Sequence[SecretStaticAccountBindingArgs]] = None,
        namespace: Optional[str] = None,
        secret_type: Optional[str] = None,
        service_account_email: Optional[str] = None,
        service_account_project: Optional[str] = None,
        static_account: Optional[str] = None,
        token_scopes: Optional[Sequence[str]] = None) -> SecretStaticAccount
    func GetSecretStaticAccount(ctx *Context, name string, id IDInput, state *SecretStaticAccountState, opts ...ResourceOption) (*SecretStaticAccount, error)
    public static SecretStaticAccount Get(string name, Input<string> id, SecretStaticAccountState? state, CustomResourceOptions? opts = null)
    public static SecretStaticAccount get(String name, Output<String> id, SecretStaticAccountState state, CustomResourceOptions options)
    resources:  _:    type: vault:gcp:SecretStaticAccount    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Backend string
    Path where the GCP Secrets Engine is mounted
    Bindings List<SecretStaticAccountBinding>
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    SecretType string
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    ServiceAccountEmail string
    Email of the GCP service account to manage.
    ServiceAccountProject string
    Project the service account belongs to.
    StaticAccount string
    Name of the Static Account to create
    TokenScopes List<string>
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).
    Backend string
    Path where the GCP Secrets Engine is mounted
    Bindings []SecretStaticAccountBindingArgs
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    SecretType string
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    ServiceAccountEmail string
    Email of the GCP service account to manage.
    ServiceAccountProject string
    Project the service account belongs to.
    StaticAccount string
    Name of the Static Account to create
    TokenScopes []string
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).
    backend String
    Path where the GCP Secrets Engine is mounted
    bindings List<SecretStaticAccountBinding>
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secretType String
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    serviceAccountEmail String
    Email of the GCP service account to manage.
    serviceAccountProject String
    Project the service account belongs to.
    staticAccount String
    Name of the Static Account to create
    tokenScopes List<String>
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).
    backend string
    Path where the GCP Secrets Engine is mounted
    bindings SecretStaticAccountBinding[]
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secretType string
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    serviceAccountEmail string
    Email of the GCP service account to manage.
    serviceAccountProject string
    Project the service account belongs to.
    staticAccount string
    Name of the Static Account to create
    tokenScopes string[]
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).
    backend str
    Path where the GCP Secrets Engine is mounted
    bindings Sequence[SecretStaticAccountBindingArgs]
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secret_type str
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    service_account_email str
    Email of the GCP service account to manage.
    service_account_project str
    Project the service account belongs to.
    static_account str
    Name of the Static Account to create
    token_scopes Sequence[str]
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).
    backend String
    Path where the GCP Secrets Engine is mounted
    bindings List<Property Map>
    Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secretType String
    Type of secret generated for this static account. Accepted values: access_token, service_account_key. Defaults to access_token.
    serviceAccountEmail String
    Email of the GCP service account to manage.
    serviceAccountProject String
    Project the service account belongs to.
    staticAccount String
    Name of the Static Account to create
    tokenScopes List<String>
    List of OAuth scopes to assign to access_token secrets generated under this static account (access_token static accounts only).

    Supporting Types

    SecretStaticAccountBinding, SecretStaticAccountBindingArgs

    Resource string
    Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
    Roles List<string>
    List of GCP IAM roles for the resource.
    Resource string
    Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
    Roles []string
    List of GCP IAM roles for the resource.
    resource String
    Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
    roles List<String>
    List of GCP IAM roles for the resource.
    resource string
    Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
    roles string[]
    List of GCP IAM roles for the resource.
    resource str
    Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
    roles Sequence[str]
    List of GCP IAM roles for the resource.
    resource String
    Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different formats.
    roles List<String>
    List of GCP IAM roles for the resource.

    Import

    A static account can be imported using its Vault Path. For example, referencing the example above,

    $ pulumi import vault:gcp/secretStaticAccount:SecretStaticAccount static_account gcp/static-account/project_viewer

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo
    HashiCorp Vault v6.7.1 published on Friday, May 2, 2025 by Pulumi
    pulumi/pulumi-vault