# Allow listing secret parent-child connections (as in UI hierarchy). Subdir # underneath 'kv' secrets engine will remain hidden though, user has to # manually open up # ${VAULT_ADDR}/ui/vault/secrets/kv/list/for_{{identity.groups.ids.GROUPID.name}} path "kv/metadata/for_{{identity.groups.ids.GROUPID.name}}/*" { capabilities = ["list"] } # Same but without ID, this allows an orphan token (i.e. that has no parent "entity_id") to also access this path "kv/metadata/for_rbacgroup_remco/*" { capabilities = ["list"] } # Grant read-only access to secrets path "kv/data/for_{{identity.groups.ids.GROUPID.name}}/*" { capabilities = ["read"] } # Same but without ID, this allows an orphan token (i.e. that has no parent "entity_id") to also access this path "kv/data/for_rbacgroup_remco/*" { capabilities = ["read"] }