xcsh_cloud_credentials (Data Source)

Retrieves information about a Cloud Credentials resource in F5 Distributed Cloud for api to create cloud_credentials object. configuration. This is a read-only data source.

~> Note: For more information, see the Cloud Credentials API documentation.

Example Usage

# CloudCredentials Data Source Example

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Look up an existing CloudCredentials by name
data "xcsh_cloud_credentials" "example" {
  name      = "example-cloud-credentials"
  namespace = "staging"
}

output "cloud_credentials_id" {
  value = data.xcsh_cloud_credentials.example.id
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Metadata Argument Reference

• name - Required String
Name of the CloudCredentials

• namespace - Required String
Namespace where the CloudCredentials exists

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• annotations - Optional Map
Annotations applied to this resource

• aws_assume_role - Optional String
AWS Assume Role to Handle Delegated Access

• aws_secret_key - Optional String
AWS Programmatic Access Credentials type

• azure_client_secret - Optional String
Azure Client Secret. Azure Credentials Client Secret type

• azure_pfx_certificate - Optional String
Azure Credentials Client Certificate type

• description - Optional String
Description of the CloudCredentials

• gcp_cred_file - Optional String
Configuration parameter for GCP cred file

• id - Optional String
Unique identifier for the resource

• labels - Optional Map
Labels applied to this resource

• custom_external_id - Optional String
External ID is Custom ID

• duration_seconds - Optional Number
The duration, in seconds of the role session

• external_id_is_optional - Optional Object
Configuration parameter for external ID is optional

• external_id_is_tenant_id - Optional Object
Enable this option

• role_arn - Optional String
IAM Role ARN. IAM Role ARN to assume the role

• session_name - Optional String
Use the role session name to uniquely identify a session, which will be used for deploy, monitor from F5XC console

• session_tags - Optional Map
Session tags are key-value pair attributes that you pass when you assume an IAM role

• access_key - Optional String
Access Key ID. Access key ID for your AWS account

• secret_key - Optional String
SecretType is used in an object to indicate a sensitive/confidential field

• blindfold_secret_info - Optional String
BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management

• clear_secret_info - Optional String
ClearSecretInfoType specifies information about the Secret that is not encrypted

• decryption_provider - Optional String
Name of the Secret Management Access object that contains information about the backend Secret Management service

• location - Optional String
Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location

• store_provider - Optional String
Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///

• provider_ref - Optional String
Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///

• url - Optional String
URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding

• client_id - Optional String
Client ID for your Azure service principal

• client_secret - Optional String
SecretType is used in an object to indicate a sensitive/confidential field

• subscription_id - Optional String
Subscription ID for your Azure service principal

• tenant_id - Optional String
Tenant ID for your Azure service principal

• blindfold_secret_info - Optional String
BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management

• clear_secret_info - Optional String
ClearSecretInfoType specifies information about the Secret that is not encrypted

• decryption_provider - Optional String
Name of the Secret Management Access object that contains information about the backend Secret Management service

• location - Optional String
Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location

• certificate_url - Optional String
URL for Client Certificate in ‘.pfx’ or ‘.p12’ whose certificate is linked to service principal object Certificate URL can contain client certificate in string:///<Base64 of certificate> format. Here <Base64 of certificate> is base64 of ‘.pfx’ or ‘.p12’ binary file

• client_id - Optional String
Client ID for your Azure service principal

• password - Optional String
SecretType is used in an object to indicate a sensitive/confidential field

• subscription_id - Optional String
Subscription ID for your Azure service principal

• tenant_id - Optional String
Tenant ID for your Azure service principal

• blindfold_secret_info - Optional String
BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management

• clear_secret_info - Optional String
ClearSecretInfoType specifies information about the Secret that is not encrypted

• decryption_provider - Optional String
Name of the Secret Management Access object that contains information about the backend Secret Management service

• location - Optional String
Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location

• credential_file - Optional String
SecretType is used in an object to indicate a sensitive/confidential field

• blindfold_secret_info - Optional String
BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management

• clear_secret_info - Optional String
ClearSecretInfoType specifies information about the Secret that is not encrypted

• decryption_provider - Optional String
Name of the Secret Management Access object that contains information about the backend Secret Management service

• location - Optional String
Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges