Quico/vault-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix(docs): Assign policy to token, grant it access

Browse Source
This commit is contained in:
hygienic-books
2023-04-25 03:44:57 +02:00
parent 9f067d6fec
commit 6402ad542e
2 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
policies/remco/remco.hcl
View File

@@ -1,12 +1,22 @@
# Allow listing secret parent-child connections (as in UI hierarchy). Subdir
# underneath 'kv' secrets engine will remain hidden though, user has to
# manually open up
# ${VAULT_ADDR}/ui/vault/secrets/kv/list/for_{{identity.groups.ids.GROUPID.name}}
path "kv/metadata/for_{{identity.groups.ids.GROUPID.name}}/*" {
# ${VAULT_ADDR}/ui/vault/secrets/kv/list/for_{{identity.groups.ids.83754fb4-ee24-fa6a-52dd-50ef8f1d6665.name}}
path "kv/metadata/for_{{identity.groups.ids.83754fb4-ee24-fa6a-52dd-50ef8f1d6665.name}}/*" {
capabilities = ["list"]
}
# Same but without ID, this allows an orphan token (i.e. that has no parent "entity_id") to also access this
path "kv/metadata/for_rbacgroup_remco/*" {
capabilities = ["list"]
}
# Grant read-only access to secrets
path "kv/data/for_{{identity.groups.ids.GROUPID.name}}/*" {
path "kv/data/for_{{identity.groups.ids.83754fb4-ee24-fa6a-52dd-50ef8f1d6665.name}}/*" {
capabilities = ["read"]
}
# Same but without ID, this allows an orphan token (i.e. that has no parent "entity_id") to also access this
path "kv/data/for_rbacgroup_remco/*" {
capabilities = ["read"]
}