pulumi-vault

What it is and what it does

pulumi-vault is a Pulumi resource provider that bridges Pulumi's infrastructure-as-code framework with HashiCorp Vault, allowing you to declare and manage Vault resources (secrets engines, auth methods, policies, tokens) as part of your Pulumi stack. It requires the Pulumi CLI and a running Vault server; you authenticate by providing a Vault address and token, optionally with TLS certificate validation and namespace configuration. The provider automatically creates child tokens with limited TTL to reduce secret exposure.

You use it by installing the package, configuring your Vault connection details through Pulumi config or environment variables, and then writing Pulumi code in Python (or other supported languages) to create and manage Vault resources declaratively. It handles authentication, certificate validation, and retry logic, letting you version-control your Vault configuration alongside the rest of your infrastructure.

Use it for:

• Automate Vault secret engine and auth method provisioning as part of infrastructure deployment pipelines
• Define Vault policies and token roles declaratively alongside application infrastructure in Pulumi stacks
• Manage Vault namespaces and configuration in multi-tenant or enterprise Vault deployments
• Integrate Vault secret management into GitOps workflows by storing Vault resource definitions in version control
• Programmatically configure Vault certificate authentication and TLS settings during infrastructure setup

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Pulumi resource provider for HashiCorp Vault that lets you define and manage Vault resources (secrets, auth methods, policies) as code within Pulumi infrastructure programs.

Yes. Active maintenance, low install friction, permissive license, and no known vulnerabilities make it safe to adopt. Install it if you use Pulumi and need to manage Vault resources programmatically; the tight integration with Pulumi's config and secret handling is its main value. Verify that the specific Vault resource types you need are supported in this version before committing to it in production.

Install

pulumi-vault on PyPI

pip install pulumi-vault

uv add pulumi-vault

poetry add pulumi-vault

Installing pulumi-vault

Before you install

Low install friction; pure Python wheel with four lightweight runtime dependencies. Active maintenance with a release 3 days ago; repository shows ongoing commits and is not archived.

License in practice

Apache-2.0 permissive license allows commercial and private use with minimal restrictions; you must include a copy of the license and state significant changes.

Quickstart

pip install pulumi_vault

import pulumi
import pulumi_vault as vault

# Configure provider with Vault address and token
config = pulumi.Config()
vault_addr = config.require_secret('vault:address')
vault_token = config.require_secret('vault:token')

Requires Pulumi CLI to be installed first and a running Vault server with valid address and authentication token (set via VAULT_ADDR and VAULT_TOKEN environment variables or Pulumi config).

Verify before relying

• Specific Vault resource types and operations supported by this provider version
• Whether child token creation and TTL management work as documented in all Vault configurations
• TLS certificate authentication support status (description suggests it may not be implemented)

Package facts

Evidence: pulumi_vault-7.11.1-py3-none-any.whl

Keywords: pulumi, vault

Tags

More Build Tools packages