pulumi-tls

library5.5.1pypypi✓ verified 26d ago

Pulumi TLS is a Python package that provides an interface to create and manage TLS (Transport Layer Security) resources within Pulumi programs. It allows for the programmatic generation of private keys, certificate signing requests, and self-signed certificates, which can then be used with other cloud providers. The library is currently at version 5.3.1 and typically sees frequent updates to align with its upstream Terraform provider and Pulumi's core bridge updates.

auth-security devops

pip install pulumi_tls

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · PULUMI-TLS

pulumi-tls

auth-securitypythonv5.5.1

Install

6.4s avg

Import

1224ms

Disk

78MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v5.5.1 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 1.568s · 86.7MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 6.4s · import 0.880s · 73MB

78MB installed

● package 78MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

PrivateKey

✓ from pulumi_tls import PrivateKey

SelfSignedCert

✓ from pulumi_tls import SelfSignedCert

This example demonstrates how to create an RSA private key and then use it to generate a self-signed TLS certificate with specified validity and allowed uses.

import pulumi import pulumi_tls as tls # Create a new private key private_key = tls.PrivateKey("example-private-key", algorithm="RSA", rsa_bits=2048) # Create a self-signed certificate using the private key self_signed_cert = tls.SelfSignedCert("example-self-signed-cert", private_key_pem=private_key.private_key_pem, validity_period_hours=8760, # 1 year early_renewal_hours=240, # 10 days allowed_uses=[ "key_encipherment", "digital_signature", "server_auth" ], dns_names=[ "example.com", "www.example.com" ], subject={ "common_name": "example.com", "organization": "Acme, Inc." }) pulumi.export("private_key_pem", private_key.private_key_pem) pulumi.export("self_signed_certificate_pem", self_signed_cert.cert_pem)

Debug

Known issues

breakingUpgrading to a new major version (e.g., v4 to v5) may introduce breaking changes, even if not explicitly stated in patch notes, due to updates in the underlying Terraform provider or Pulumi's provider bridge. Always review the full changelog and test upgrades in a staging environment.

fix

Consult the official Pulumi TLS provider changelog on GitHub and the Pulumi Registry for detailed migration guides or breaking changes specific to the versions you are upgrading between.

affects: All major version upgrades (e.g., from 4.x to 5.x)

gotchaWhen using ECDSA with the P224 elliptic curve for PrivateKey, several OpenSSH-related attributes (e.g., `private_key_openssh`, `public_key_openssh`, `public_key_fingerprint_md5`, `public_key_fingerprint_sha256`) will be empty strings. This is due to restrictions in the SSH ECC Algorithm Integration (RFC 5656) which limits supported curves.

fix

If OpenSSH compatibility is required, use ECDSA with `P256`, `P384`, or `P521` curves, or opt for the RSA algorithm.

affects: All versions

gotchaOutput properties like `private_key_pem` or `cert_pem` might contain leading or trailing whitespace depending on the downstream system consuming the PEM string. This can lead to parsing errors in external applications.

fix

Always trim whitespace from PEM output strings using string methods like `.strip()` in Python before passing them to other tools or services if you encounter parsing issues.

affects: All versions

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'pulumi_tls'

The 'pulumi-tls' Python package has not been installed in the active Python environment or virtual environment, or the environment is not correctly configured for Pulumi.

fix

Run `pip install pulumi_tls` to install the package. If using a virtual environment, ensure it's activated and run `pip install pulumi_tls` or `venv/bin/pip install pulumi_tls`.

TypeError: __init__() got an unexpected keyword argument 'X'

An incorrect or deprecated keyword argument was passed to a `pulumi-tls` resource constructor, often due to a version mismatch between the Pulumi CLI/SDK and the `pulumi-tls` provider, or a typo in the property name.

fix

Consult the official `pulumi-tls` API documentation for the specific resource and version you are using to verify correct property names. Upgrade the `pulumi-tls` provider if necessary using `pip install --upgrade pulumi_tls`.

Error: tls: failed to parse private key

The private key PEM string provided to a `pulumi-tls` resource (e.g., `tls.CertRequest`, `tls.SelfSignedCert`, `tls.PrivateKey`) is malformed, corrupted, or in an unsupported format.

fix

Ensure the private key is in a valid PEM (RFC 1421) format and includes the correct headers and footers (e.g., `-----BEGIN PRIVATE KEY-----`). Double-check the key content for any errors or unexpected characters.

from tls import PrivateKey

The Python import statement incorrectly assumes the top-level module name for the Pulumi TLS provider is 'tls' rather than 'pulumi_tls'.

fix

Change the import statement to `import pulumi_tls as tls` or `from pulumi_tls import PrivateKey` to correctly reference the installed package.

Upgrade

Version history

5.5.1latest on PyPI · released Jul 22, 2026

Audit

Dependencies

pulumirequiredCore dependency for all Pulumi providers and programs.

Agent activity

16 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/pulumi/pulumi-tls ↗

packagehttps://pypi.org/project/pulumi-tls/ ↗

homepagehttps://pulumi.io ↗