Google Cloud secrets engine (API)
Last updated
Last updated
This is the API documentation for the Vault Google Cloud Platform (GCP) secrets engine. For general information about the usage and operation of the GCP secrets engine, please see these docs.
This documentation assumes the GCP secrets engine is enabled at the /gcp
path in Vault. Since it is possible to mount secrets engines at any path, please update your API calls accordingly.
Method | Path |
---|---|
This endpoint configures shared information for the secrets engine.
credentials
(string:""
) - JSON credentials (either file contents or '@path/to/file') See docs for alternative ways to pass in to this parameter, as well as the required permissions.
ttl
(int: 0 || string:"0s"
) – Specifies default config TTL for long-lived credentials (i.e. service account keys). Uses duration format strings.
max_ttl
(int: 0 || string:"0s"
)– Specifies the maximum config TTL for long-lived credentials (i.e. service account keys). Uses duration format strings.**
Request to rotate the GCP service account credentials used by Vault for this mount. A new key will be generated for the service account, replacing the internal value, and then a deletion of the old service account key is scheduled. Note that this does not create a new service account, only a new version of the service account key.
This path is only valid if Vault has been configured to use GCP credentials via the config/
endpoint where "credentials" were specified. Additionally, the provided service account must have permissions to create and delete service account keys.
Credentials will be omitted from returned data.
This method allows you to create a roleset or update an existing roleset. See docs for the GCP secrets backend to learn more about what happens when you create or update a roleset.
If you update a roleset's bindings, this will effectively revoke any secrets generated under this roleset.
name
(string: <required>
): Required. Name of the role. Cannot be updated.
secret_type
(string: "access_token"
): Type of secret generated for this role set. Accepted values: access_token
, service_account_key
. Cannot be updated.
project
(string: <required>
): Name of the GCP project that this roleset's service account will belong to. Cannot be updated.
bindings
(string: <required>
): Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string)
token_scopes
(array: []
): List of OAuth scopes to assign to access_token
secrets generated under this role set (access_token
role sets only)
Sample bindings:
See bindings format docs for more information.
This will rotate the service account this roleset uses to generate secrets. (this also replaces the key access_token
roleset). This can be used to invalidate old secrets generated by the roleset or fix issues if a roleset's service account (and/or keys) was changed outside of Vault (i.e. through GCP APIs/cloud console).
access_token
roleset only)This will rotate the service account key this roleset uses to generate access tokens. This does not recreate the roleset service account.
name
(string:<required>
): Name of the roleset to read.
This endpoint deletes an existing roleset by the given name.
name
(string:<required>
): Name of the roleset to delete.
This method allows you to create a static account or update an existing static account. See docs for the GCP secrets backend to learn more about what happens when you create or update a static account.
If you update a static account's bindings, this will effectively revoke any secrets generated under this static account.
name
(string: <required>
): Name of the static account. Cannot be updated.
secret_type
(string: "access_token"
): Type of secret generated for this static account. Accepted values: access_token
, service_account_key
. Cannot be updated.
service_account_email
(string: <required>
): Email of the GCP service account to manage. Cannot be updated.
bindings
(string
): Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string). Optional.
token_scopes
(array: []
): List of OAuth scopes to assign to access_token
secrets generated under this static account (access_token
static accounts only)
Sample bindings:
See bindings format docs for more information.
access_token
static account only)This will rotate the service account key this static account uses to generate access tokens. This does not recreate the service account.
name
(string:<required>
): Name of the static account to read.
This endpoint will only return bindings that are managed through the secrets engine. Bindings manually managed outside of Vault will not be returned.
This endpoint deletes an existing static account by the given name.
name
(string:<required>
): Name of the static account to delete.
This method allows you to create an impersonated account or update an existing impersonated account.
name
(string: <required>
): Name of the impersonated account. Cannot be updated.
service_account_email
(string: <required>
): Email of the GCP service account to manage. Cannot be updated.
token_scopes
(array: []
): List of OAuth scopes to assign to access tokens generated under this impersonation account.
ttl
(duration: ""
): Lifetime of the token generated. Defaults to 1 hour and is limited to a maximum of 12 hours. Uses duration format strings.
name
(string:<required>
): Name of the impersonated account to read.
This endpoint lists the configured Vault roles for impersonated accounts.
This endpoint deletes an existing impersonated account by the given name.
name
(string:<required>
): Name of the impersonated account to delete.
Generates an OAuth2 token with the scopes defined on the roleset, static account, or impersonated account. This OAuth access token can be used in GCP API calls, e.g. curl -H "Authorization: Bearer $TOKEN" ...
Tokens are non-revocable and non-renewable and have a static TTL of an hour. The TTL configured for the backend (either through the default system TTLs or through the config/
endpoint) do not apply.
roleset
(string:<required>
): Name of an roleset with secret type access_token
to generate access_token under.
static-account
(string:<required>
): Name of the static account with secret type access_token
to generate access_token under.
impersonated-account
(string:<required>
): Name of the impersonated account to generate access_token_under.
Roleset:
Static account:
Impersonated account:
If using GET
('read'), the optional parameters will be set to their defaults. Use POST
if you want to specify different values for these params.
These keys are renewable and have TTL/max TTL as defined by either the backend config or the system default if config was not defined.
roleset
(string:<required>
): Name of an roleset with secret type service_account_key
to generate key under.
static-account
(string:<required>
): Name of an static account with secret type service_account_key
to generate key under.
key_algorithm
(string:"KEY_ALG_RSA_2048"
): Key algorithm used to generate key. Defaults to 2k RSA key You probably should not choose other values (i.e. 1k), but accepted values are enum(ServiceAccountKeyAlgorithm)
key_type
(string:"TYPE_GOOGLE_CREDENTIALS_FILE
): Private key type to generate. Defaults to JSON credentials file. Accepted values are enum(ServiceAccountPrivateKeyType)
ttl
(string: ""
): Specifies the Time To Live value provided using a duration format string. If not set, uses the system default value.
See docs on how to renew and revoke leases. Note this only applies to service account keys.
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path | |
---|---|---|
Method | Path | |
---|---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path | |
---|---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|
Method | Path |
---|---|