diff --git a/policies/administrator/administrator.hcl b/policies/administrator/administrator.hcl index 36fd1f5..e861f7f 100644 --- a/policies/administrator/administrator.hcl +++ b/policies/administrator/administrator.hcl @@ -6,16 +6,21 @@ path "sys/health" # Create and manage ACL policies broadly across Vault +# Display the Policies tab in UI +path "sys/policies" { + capabilities = ["read", "list"] +} + # List existing policies path "sys/policies/acl" { - capabilities = ["list"] + capabilities = ["read", "list"] } # Create and manage ACL policies path "sys/policies/acl/*" { - capabilities = ["create", "read", "update", "delete", "list", "sudo"] + capabilities = ["create", "read", "update", "delete", "list"] } # Enable and manage authentication methods broadly across Vault @@ -29,13 +34,13 @@ path "auth/*" # Create, update, and delete auth methods path "sys/auth/*" { - capabilities = ["create", "update", "delete", "sudo"] + capabilities = ["create", "update", "read", "delete", "list", "sudo"] } # List auth methods path "sys/auth" { - capabilities = ["read"] + capabilities = ["read", "list"] } # Enable and manage the key/value secrets engine at `secret/` path @@ -58,26 +63,7 @@ path "sys/mounts" capabilities = ["read"] } -# Allow creation of groups -path "identity/group" -{ - capabilities = ["update"] -} - -# Allow renaming of groups -path "identity/group/+/+" -{ - capabilities = ["update"] -} - -# Allow listing and reading of groups and group attributes -path "identity/groups/+/+" -{ - capabilities = ["list", "read"] -} - -# Allow listing and reading of entities and entity attributes -path "identity/entity/+/+" -{ - capabilities = ["list", "read"] -} +# Create and manage entities and groups +path "identity/*" { + capabilities = [ "create", "read", "update", "delete", "list" ] +} \ No newline at end of file