# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from .. import _utilities
from . import outputs
from ._inputs import *

__all__ = ['BackendRoleArgs', 'BackendRole']

@pulumi.input_type
class BackendRoleArgs:
    def __init__(__self__, *,
                 role: pulumi.Input[_builtins.str],
                 application_object_id: Optional[pulumi.Input[_builtins.str]] = None,
                 azure_groups: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]] = None,
                 azure_roles: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]] = None,
                 backend: Optional[pulumi.Input[_builtins.str]] = None,
                 description: Optional[pulumi.Input[_builtins.str]] = None,
                 explicit_max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
                 max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
                 namespace: Optional[pulumi.Input[_builtins.str]] = None,
                 permanently_delete: Optional[pulumi.Input[_builtins.bool]] = None,
                 persist_app: Optional[pulumi.Input[_builtins.bool]] = None,
                 sign_in_audience: Optional[pulumi.Input[_builtins.str]] = None,
                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 ttl: Optional[pulumi.Input[_builtins.str]] = None):
        """
        The set of arguments for constructing a BackendRole resource.
        :param pulumi.Input[_builtins.str] role: Name of the Azure role
        :param pulumi.Input[_builtins.str] application_object_id: Application Object ID for an existing service principal that will
               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
        :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]] azure_groups: List of Azure groups to be assigned to the generated service principal.
        :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]] azure_roles: List of Azure roles to be assigned to the generated service principal.
        :param pulumi.Input[_builtins.str] backend: Path to the mounted Azure auth backend
        :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
        :param pulumi.Input[_builtins.str] explicit_max_ttl: Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
        :param pulumi.Input[_builtins.str] max_ttl: Specifies the maximum TTL for service principals generated using this role. Accepts time
               suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
               The value should not contain leading or trailing forward slashes.
               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
               *Available only for Vault Enterprise*.
        :param pulumi.Input[_builtins.bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
        :param pulumi.Input[_builtins.bool] persist_app: If set to true, persists the created service principal and application for the lifetime of the role
        :param pulumi.Input[_builtins.str] sign_in_audience: Specifies the security principal types that are allowed to sign in to the application.
               Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] tags: A list of Azure tags to attach to an application. Requires Vault 1.16+.
        :param pulumi.Input[_builtins.str] ttl: Specifies the default TTL for service principals generated using this role.
               Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
        """
        pulumi.set(__self__, "role", role)
        if application_object_id is not None:
            pulumi.set(__self__, "application_object_id", application_object_id)
        if azure_groups is not None:
            pulumi.set(__self__, "azure_groups", azure_groups)
        if azure_roles is not None:
            pulumi.set(__self__, "azure_roles", azure_roles)
        if backend is not None:
            pulumi.set(__self__, "backend", backend)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if explicit_max_ttl is not None:
            pulumi.set(__self__, "explicit_max_ttl", explicit_max_ttl)
        if max_ttl is not None:
            pulumi.set(__self__, "max_ttl", max_ttl)
        if namespace is not None:
            pulumi.set(__self__, "namespace", namespace)
        if permanently_delete is not None:
            pulumi.set(__self__, "permanently_delete", permanently_delete)
        if persist_app is not None:
            pulumi.set(__self__, "persist_app", persist_app)
        if sign_in_audience is not None:
            pulumi.set(__self__, "sign_in_audience", sign_in_audience)
        if tags is not None:
            pulumi.set(__self__, "tags", tags)
        if ttl is not None:
            pulumi.set(__self__, "ttl", ttl)

    @_builtins.property
    @pulumi.getter
    def role(self) -> pulumi.Input[_builtins.str]:
        """
        Name of the Azure role
        """
        return pulumi.get(self, "role")

    @role.setter
    def role(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "role", value)

    @_builtins.property
    @pulumi.getter(name="applicationObjectId")
    def application_object_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Application Object ID for an existing service principal that will
        be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
        """
        return pulumi.get(self, "application_object_id")

    @application_object_id.setter
    def application_object_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "application_object_id", value)

    @_builtins.property
    @pulumi.getter(name="azureGroups")
    def azure_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]]:
        """
        List of Azure groups to be assigned to the generated service principal.
        """
        return pulumi.get(self, "azure_groups")

    @azure_groups.setter
    def azure_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]]):
        pulumi.set(self, "azure_groups", value)

    @_builtins.property
    @pulumi.getter(name="azureRoles")
    def azure_roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]]:
        """
        List of Azure roles to be assigned to the generated service principal.
        """
        return pulumi.get(self, "azure_roles")

    @azure_roles.setter
    def azure_roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]]):
        pulumi.set(self, "azure_roles", value)

    @_builtins.property
    @pulumi.getter
    def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Path to the mounted Azure auth backend
        """
        return pulumi.get(self, "backend")

    @backend.setter
    def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "backend", value)

    @_builtins.property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Human-friendly description of the mount for the backend.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "description", value)

    @_builtins.property
    @pulumi.getter(name="explicitMaxTtl")
    def explicit_max_ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
        """
        return pulumi.get(self, "explicit_max_ttl")

    @explicit_max_ttl.setter
    def explicit_max_ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "explicit_max_ttl", value)

    @_builtins.property
    @pulumi.getter(name="maxTtl")
    def max_ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Specifies the maximum TTL for service principals generated using this role. Accepts time
        suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
        """
        return pulumi.get(self, "max_ttl")

    @max_ttl.setter
    def max_ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "max_ttl", value)

    @_builtins.property
    @pulumi.getter
    def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The namespace to provision the resource in.
        The value should not contain leading or trailing forward slashes.
        The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
        *Available only for Vault Enterprise*.
        """
        return pulumi.get(self, "namespace")

    @namespace.setter
    def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "namespace", value)

    @_builtins.property
    @pulumi.getter(name="permanentlyDelete")
    def permanently_delete(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Indicates whether the applications and service principals created by Vault will be permanently
        deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
        """
        return pulumi.get(self, "permanently_delete")

    @permanently_delete.setter
    def permanently_delete(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "permanently_delete", value)

    @_builtins.property
    @pulumi.getter(name="persistApp")
    def persist_app(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        If set to true, persists the created service principal and application for the lifetime of the role
        """
        return pulumi.get(self, "persist_app")

    @persist_app.setter
    def persist_app(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "persist_app", value)

    @_builtins.property
    @pulumi.getter(name="signInAudience")
    def sign_in_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Specifies the security principal types that are allowed to sign in to the application.
        Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
        """
        return pulumi.get(self, "sign_in_audience")

    @sign_in_audience.setter
    def sign_in_audience(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "sign_in_audience", value)

    @_builtins.property
    @pulumi.getter
    def tags(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        A list of Azure tags to attach to an application. Requires Vault 1.16+.
        """
        return pulumi.get(self, "tags")

    @tags.setter
    def tags(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "tags", value)

    @_builtins.property
    @pulumi.getter
    def ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Specifies the default TTL for service principals generated using this role.
        Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
        """
        return pulumi.get(self, "ttl")

    @ttl.setter
    def ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "ttl", value)


@pulumi.input_type
class _BackendRoleState:
    def __init__(__self__, *,
                 application_object_id: Optional[pulumi.Input[_builtins.str]] = None,
                 azure_groups: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]] = None,
                 azure_roles: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]] = None,
                 backend: Optional[pulumi.Input[_builtins.str]] = None,
                 description: Optional[pulumi.Input[_builtins.str]] = None,
                 explicit_max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
                 max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
                 namespace: Optional[pulumi.Input[_builtins.str]] = None,
                 permanently_delete: Optional[pulumi.Input[_builtins.bool]] = None,
                 persist_app: Optional[pulumi.Input[_builtins.bool]] = None,
                 role: Optional[pulumi.Input[_builtins.str]] = None,
                 sign_in_audience: Optional[pulumi.Input[_builtins.str]] = None,
                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 ttl: Optional[pulumi.Input[_builtins.str]] = None):
        """
        Input properties used for looking up and filtering BackendRole resources.
        :param pulumi.Input[_builtins.str] application_object_id: Application Object ID for an existing service principal that will
               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
        :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]] azure_groups: List of Azure groups to be assigned to the generated service principal.
        :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]] azure_roles: List of Azure roles to be assigned to the generated service principal.
        :param pulumi.Input[_builtins.str] backend: Path to the mounted Azure auth backend
        :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
        :param pulumi.Input[_builtins.str] explicit_max_ttl: Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
        :param pulumi.Input[_builtins.str] max_ttl: Specifies the maximum TTL for service principals generated using this role. Accepts time
               suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
               The value should not contain leading or trailing forward slashes.
               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
               *Available only for Vault Enterprise*.
        :param pulumi.Input[_builtins.bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
        :param pulumi.Input[_builtins.bool] persist_app: If set to true, persists the created service principal and application for the lifetime of the role
        :param pulumi.Input[_builtins.str] role: Name of the Azure role
        :param pulumi.Input[_builtins.str] sign_in_audience: Specifies the security principal types that are allowed to sign in to the application.
               Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] tags: A list of Azure tags to attach to an application. Requires Vault 1.16+.
        :param pulumi.Input[_builtins.str] ttl: Specifies the default TTL for service principals generated using this role.
               Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
        """
        if application_object_id is not None:
            pulumi.set(__self__, "application_object_id", application_object_id)
        if azure_groups is not None:
            pulumi.set(__self__, "azure_groups", azure_groups)
        if azure_roles is not None:
            pulumi.set(__self__, "azure_roles", azure_roles)
        if backend is not None:
            pulumi.set(__self__, "backend", backend)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if explicit_max_ttl is not None:
            pulumi.set(__self__, "explicit_max_ttl", explicit_max_ttl)
        if max_ttl is not None:
            pulumi.set(__self__, "max_ttl", max_ttl)
        if namespace is not None:
            pulumi.set(__self__, "namespace", namespace)
        if permanently_delete is not None:
            pulumi.set(__self__, "permanently_delete", permanently_delete)
        if persist_app is not None:
            pulumi.set(__self__, "persist_app", persist_app)
        if role is not None:
            pulumi.set(__self__, "role", role)
        if sign_in_audience is not None:
            pulumi.set(__self__, "sign_in_audience", sign_in_audience)
        if tags is not None:
            pulumi.set(__self__, "tags", tags)
        if ttl is not None:
            pulumi.set(__self__, "ttl", ttl)

    @_builtins.property
    @pulumi.getter(name="applicationObjectId")
    def application_object_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Application Object ID for an existing service principal that will
        be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
        """
        return pulumi.get(self, "application_object_id")

    @application_object_id.setter
    def application_object_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "application_object_id", value)

    @_builtins.property
    @pulumi.getter(name="azureGroups")
    def azure_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]]:
        """
        List of Azure groups to be assigned to the generated service principal.
        """
        return pulumi.get(self, "azure_groups")

    @azure_groups.setter
    def azure_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]]]):
        pulumi.set(self, "azure_groups", value)

    @_builtins.property
    @pulumi.getter(name="azureRoles")
    def azure_roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]]:
        """
        List of Azure roles to be assigned to the generated service principal.
        """
        return pulumi.get(self, "azure_roles")

    @azure_roles.setter
    def azure_roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]]]):
        pulumi.set(self, "azure_roles", value)

    @_builtins.property
    @pulumi.getter
    def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Path to the mounted Azure auth backend
        """
        return pulumi.get(self, "backend")

    @backend.setter
    def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "backend", value)

    @_builtins.property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Human-friendly description of the mount for the backend.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "description", value)

    @_builtins.property
    @pulumi.getter(name="explicitMaxTtl")
    def explicit_max_ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
        """
        return pulumi.get(self, "explicit_max_ttl")

    @explicit_max_ttl.setter
    def explicit_max_ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "explicit_max_ttl", value)

    @_builtins.property
    @pulumi.getter(name="maxTtl")
    def max_ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Specifies the maximum TTL for service principals generated using this role. Accepts time
        suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
        """
        return pulumi.get(self, "max_ttl")

    @max_ttl.setter
    def max_ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "max_ttl", value)

    @_builtins.property
    @pulumi.getter
    def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The namespace to provision the resource in.
        The value should not contain leading or trailing forward slashes.
        The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
        *Available only for Vault Enterprise*.
        """
        return pulumi.get(self, "namespace")

    @namespace.setter
    def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "namespace", value)

    @_builtins.property
    @pulumi.getter(name="permanentlyDelete")
    def permanently_delete(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Indicates whether the applications and service principals created by Vault will be permanently
        deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
        """
        return pulumi.get(self, "permanently_delete")

    @permanently_delete.setter
    def permanently_delete(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "permanently_delete", value)

    @_builtins.property
    @pulumi.getter(name="persistApp")
    def persist_app(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        If set to true, persists the created service principal and application for the lifetime of the role
        """
        return pulumi.get(self, "persist_app")

    @persist_app.setter
    def persist_app(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "persist_app", value)

    @_builtins.property
    @pulumi.getter
    def role(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Name of the Azure role
        """
        return pulumi.get(self, "role")

    @role.setter
    def role(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "role", value)

    @_builtins.property
    @pulumi.getter(name="signInAudience")
    def sign_in_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Specifies the security principal types that are allowed to sign in to the application.
        Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
        """
        return pulumi.get(self, "sign_in_audience")

    @sign_in_audience.setter
    def sign_in_audience(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "sign_in_audience", value)

    @_builtins.property
    @pulumi.getter
    def tags(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        A list of Azure tags to attach to an application. Requires Vault 1.16+.
        """
        return pulumi.get(self, "tags")

    @tags.setter
    def tags(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "tags", value)

    @_builtins.property
    @pulumi.getter
    def ttl(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Specifies the default TTL for service principals generated using this role.
        Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
        """
        return pulumi.get(self, "ttl")

    @ttl.setter
    def ttl(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "ttl", value)


@pulumi.type_token("vault:azure/backendRole:BackendRole")
class BackendRole(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 application_object_id: Optional[pulumi.Input[_builtins.str]] = None,
                 azure_groups: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureGroupArgs', 'BackendRoleAzureGroupArgsDict']]]]] = None,
                 azure_roles: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureRoleArgs', 'BackendRoleAzureRoleArgsDict']]]]] = None,
                 backend: Optional[pulumi.Input[_builtins.str]] = None,
                 description: Optional[pulumi.Input[_builtins.str]] = None,
                 explicit_max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
                 max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
                 namespace: Optional[pulumi.Input[_builtins.str]] = None,
                 permanently_delete: Optional[pulumi.Input[_builtins.bool]] = None,
                 persist_app: Optional[pulumi.Input[_builtins.bool]] = None,
                 role: Optional[pulumi.Input[_builtins.str]] = None,
                 sign_in_audience: Optional[pulumi.Input[_builtins.str]] = None,
                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 ttl: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        """
        ## Example Usage

        ```python
        import pulumi
        import pulumi_vault as vault

        azure = vault.azure.Backend("azure",
            subscription_id=subscription_id,
            tenant_id=tenant_id,
            client_secret=client_secret,
            client_id=client_id)
        generated_role = vault.azure.BackendRole("generated_role",
            backend=azure.path,
            role="generated_role",
            sign_in_audience="AzureADMyOrg",
            tags=[
                "team:engineering",
                "environment:development",
            ],
            ttl="300",
            max_ttl="600",
            azure_roles=[{
                "role_name": "Reader",
                "scope": f"/subscriptions/{subscription_id}/resourceGroups/azure-vault-group",
            }])
        existing_object_id = vault.azure.BackendRole("existing_object_id",
            backend=azure.path,
            role="existing_object_id",
            application_object_id="11111111-2222-3333-4444-44444444444",
            ttl="300",
            max_ttl="600")
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] application_object_id: Application Object ID for an existing service principal that will
               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
        :param pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureGroupArgs', 'BackendRoleAzureGroupArgsDict']]]] azure_groups: List of Azure groups to be assigned to the generated service principal.
        :param pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureRoleArgs', 'BackendRoleAzureRoleArgsDict']]]] azure_roles: List of Azure roles to be assigned to the generated service principal.
        :param pulumi.Input[_builtins.str] backend: Path to the mounted Azure auth backend
        :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
        :param pulumi.Input[_builtins.str] explicit_max_ttl: Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
        :param pulumi.Input[_builtins.str] max_ttl: Specifies the maximum TTL for service principals generated using this role. Accepts time
               suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
               The value should not contain leading or trailing forward slashes.
               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
               *Available only for Vault Enterprise*.
        :param pulumi.Input[_builtins.bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
        :param pulumi.Input[_builtins.bool] persist_app: If set to true, persists the created service principal and application for the lifetime of the role
        :param pulumi.Input[_builtins.str] role: Name of the Azure role
        :param pulumi.Input[_builtins.str] sign_in_audience: Specifies the security principal types that are allowed to sign in to the application.
               Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] tags: A list of Azure tags to attach to an application. Requires Vault 1.16+.
        :param pulumi.Input[_builtins.str] ttl: Specifies the default TTL for service principals generated using this role.
               Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: BackendRoleArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        ## Example Usage

        ```python
        import pulumi
        import pulumi_vault as vault

        azure = vault.azure.Backend("azure",
            subscription_id=subscription_id,
            tenant_id=tenant_id,
            client_secret=client_secret,
            client_id=client_id)
        generated_role = vault.azure.BackendRole("generated_role",
            backend=azure.path,
            role="generated_role",
            sign_in_audience="AzureADMyOrg",
            tags=[
                "team:engineering",
                "environment:development",
            ],
            ttl="300",
            max_ttl="600",
            azure_roles=[{
                "role_name": "Reader",
                "scope": f"/subscriptions/{subscription_id}/resourceGroups/azure-vault-group",
            }])
        existing_object_id = vault.azure.BackendRole("existing_object_id",
            backend=azure.path,
            role="existing_object_id",
            application_object_id="11111111-2222-3333-4444-44444444444",
            ttl="300",
            max_ttl="600")
        ```

        :param str resource_name: The name of the resource.
        :param BackendRoleArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(BackendRoleArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 application_object_id: Optional[pulumi.Input[_builtins.str]] = None,
                 azure_groups: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureGroupArgs', 'BackendRoleAzureGroupArgsDict']]]]] = None,
                 azure_roles: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureRoleArgs', 'BackendRoleAzureRoleArgsDict']]]]] = None,
                 backend: Optional[pulumi.Input[_builtins.str]] = None,
                 description: Optional[pulumi.Input[_builtins.str]] = None,
                 explicit_max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
                 max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
                 namespace: Optional[pulumi.Input[_builtins.str]] = None,
                 permanently_delete: Optional[pulumi.Input[_builtins.bool]] = None,
                 persist_app: Optional[pulumi.Input[_builtins.bool]] = None,
                 role: Optional[pulumi.Input[_builtins.str]] = None,
                 sign_in_audience: Optional[pulumi.Input[_builtins.str]] = None,
                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 ttl: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = BackendRoleArgs.__new__(BackendRoleArgs)

            __props__.__dict__["application_object_id"] = application_object_id
            __props__.__dict__["azure_groups"] = azure_groups
            __props__.__dict__["azure_roles"] = azure_roles
            __props__.__dict__["backend"] = backend
            __props__.__dict__["description"] = description
            __props__.__dict__["explicit_max_ttl"] = explicit_max_ttl
            __props__.__dict__["max_ttl"] = max_ttl
            __props__.__dict__["namespace"] = namespace
            __props__.__dict__["permanently_delete"] = permanently_delete
            __props__.__dict__["persist_app"] = persist_app
            if role is None and not opts.urn:
                raise TypeError("Missing required property 'role'")
            __props__.__dict__["role"] = role
            __props__.__dict__["sign_in_audience"] = sign_in_audience
            __props__.__dict__["tags"] = tags
            __props__.__dict__["ttl"] = ttl
        super(BackendRole, __self__).__init__(
            'vault:azure/backendRole:BackendRole',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            application_object_id: Optional[pulumi.Input[_builtins.str]] = None,
            azure_groups: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureGroupArgs', 'BackendRoleAzureGroupArgsDict']]]]] = None,
            azure_roles: Optional[pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureRoleArgs', 'BackendRoleAzureRoleArgsDict']]]]] = None,
            backend: Optional[pulumi.Input[_builtins.str]] = None,
            description: Optional[pulumi.Input[_builtins.str]] = None,
            explicit_max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
            max_ttl: Optional[pulumi.Input[_builtins.str]] = None,
            namespace: Optional[pulumi.Input[_builtins.str]] = None,
            permanently_delete: Optional[pulumi.Input[_builtins.bool]] = None,
            persist_app: Optional[pulumi.Input[_builtins.bool]] = None,
            role: Optional[pulumi.Input[_builtins.str]] = None,
            sign_in_audience: Optional[pulumi.Input[_builtins.str]] = None,
            tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
            ttl: Optional[pulumi.Input[_builtins.str]] = None) -> 'BackendRole':
        """
        Get an existing BackendRole resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] application_object_id: Application Object ID for an existing service principal that will
               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
        :param pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureGroupArgs', 'BackendRoleAzureGroupArgsDict']]]] azure_groups: List of Azure groups to be assigned to the generated service principal.
        :param pulumi.Input[Sequence[pulumi.Input[Union['BackendRoleAzureRoleArgs', 'BackendRoleAzureRoleArgsDict']]]] azure_roles: List of Azure roles to be assigned to the generated service principal.
        :param pulumi.Input[_builtins.str] backend: Path to the mounted Azure auth backend
        :param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
        :param pulumi.Input[_builtins.str] explicit_max_ttl: Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
        :param pulumi.Input[_builtins.str] max_ttl: Specifies the maximum TTL for service principals generated using this role. Accepts time
               suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
               The value should not contain leading or trailing forward slashes.
               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
               *Available only for Vault Enterprise*.
        :param pulumi.Input[_builtins.bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
        :param pulumi.Input[_builtins.bool] persist_app: If set to true, persists the created service principal and application for the lifetime of the role
        :param pulumi.Input[_builtins.str] role: Name of the Azure role
        :param pulumi.Input[_builtins.str] sign_in_audience: Specifies the security principal types that are allowed to sign in to the application.
               Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] tags: A list of Azure tags to attach to an application. Requires Vault 1.16+.
        :param pulumi.Input[_builtins.str] ttl: Specifies the default TTL for service principals generated using this role.
               Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _BackendRoleState.__new__(_BackendRoleState)

        __props__.__dict__["application_object_id"] = application_object_id
        __props__.__dict__["azure_groups"] = azure_groups
        __props__.__dict__["azure_roles"] = azure_roles
        __props__.__dict__["backend"] = backend
        __props__.__dict__["description"] = description
        __props__.__dict__["explicit_max_ttl"] = explicit_max_ttl
        __props__.__dict__["max_ttl"] = max_ttl
        __props__.__dict__["namespace"] = namespace
        __props__.__dict__["permanently_delete"] = permanently_delete
        __props__.__dict__["persist_app"] = persist_app
        __props__.__dict__["role"] = role
        __props__.__dict__["sign_in_audience"] = sign_in_audience
        __props__.__dict__["tags"] = tags
        __props__.__dict__["ttl"] = ttl
        return BackendRole(resource_name, opts=opts, __props__=__props__)

    @_builtins.property
    @pulumi.getter(name="applicationObjectId")
    def application_object_id(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Application Object ID for an existing service principal that will
        be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
        """
        return pulumi.get(self, "application_object_id")

    @_builtins.property
    @pulumi.getter(name="azureGroups")
    def azure_groups(self) -> pulumi.Output[Optional[Sequence['outputs.BackendRoleAzureGroup']]]:
        """
        List of Azure groups to be assigned to the generated service principal.
        """
        return pulumi.get(self, "azure_groups")

    @_builtins.property
    @pulumi.getter(name="azureRoles")
    def azure_roles(self) -> pulumi.Output[Optional[Sequence['outputs.BackendRoleAzureRole']]]:
        """
        List of Azure roles to be assigned to the generated service principal.
        """
        return pulumi.get(self, "azure_roles")

    @_builtins.property
    @pulumi.getter
    def backend(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Path to the mounted Azure auth backend
        """
        return pulumi.get(self, "backend")

    @_builtins.property
    @pulumi.getter
    def description(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Human-friendly description of the mount for the backend.
        """
        return pulumi.get(self, "description")

    @_builtins.property
    @pulumi.getter(name="explicitMaxTtl")
    def explicit_max_ttl(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
        """
        return pulumi.get(self, "explicit_max_ttl")

    @_builtins.property
    @pulumi.getter(name="maxTtl")
    def max_ttl(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Specifies the maximum TTL for service principals generated using this role. Accepts time
        suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
        """
        return pulumi.get(self, "max_ttl")

    @_builtins.property
    @pulumi.getter
    def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The namespace to provision the resource in.
        The value should not contain leading or trailing forward slashes.
        The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
        *Available only for Vault Enterprise*.
        """
        return pulumi.get(self, "namespace")

    @_builtins.property
    @pulumi.getter(name="permanentlyDelete")
    def permanently_delete(self) -> pulumi.Output[_builtins.bool]:
        """
        Indicates whether the applications and service principals created by Vault will be permanently
        deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
        """
        return pulumi.get(self, "permanently_delete")

    @_builtins.property
    @pulumi.getter(name="persistApp")
    def persist_app(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        If set to true, persists the created service principal and application for the lifetime of the role
        """
        return pulumi.get(self, "persist_app")

    @_builtins.property
    @pulumi.getter
    def role(self) -> pulumi.Output[_builtins.str]:
        """
        Name of the Azure role
        """
        return pulumi.get(self, "role")

    @_builtins.property
    @pulumi.getter(name="signInAudience")
    def sign_in_audience(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Specifies the security principal types that are allowed to sign in to the application.
        Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
        """
        return pulumi.get(self, "sign_in_audience")

    @_builtins.property
    @pulumi.getter
    def tags(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
        """
        A list of Azure tags to attach to an application. Requires Vault 1.16+.
        """
        return pulumi.get(self, "tags")

    @_builtins.property
    @pulumi.getter
    def ttl(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Specifies the default TTL for service principals generated using this role.
        Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
        """
        return pulumi.get(self, "ttl")

