DevOps-Security-Agent-Skills/security/secrets/hashicorp-vault/references/vault-policies.md

Vault Policy Guide

Policy Syntax

# Basic policy structure
path "secret/data/myapp/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

Capabilities

Capability	HTTP Verb	Description
create	POST/PUT	Create new data
read	GET	Read data
update	POST/PUT	Update existing data
delete	DELETE	Delete data
list	LIST	List keys
sudo	-	Root-protected paths
deny	-	Explicitly deny access

Common Policies

Application Read-Only

# app-readonly.hcl
path "secret/data/myapp/*" {
  capabilities = ["read", "list"]
}

path "secret/metadata/myapp/*" {
  capabilities = ["read", "list"]
}

Developer Policy

# developer.hcl
path "secret/data/dev/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

path "secret/data/staging/*" {
  capabilities = ["read", "list"]
}

# Deny production access
path "secret/data/prod/*" {
  capabilities = ["deny"]
}

CI/CD Pipeline

# cicd.hcl
# Read deployment secrets
path "secret/data/deploy/*" {
  capabilities = ["read"]
}

# Generate dynamic database credentials
path "database/creds/myapp-role" {
  capabilities = ["read"]
}

# Sign SSH keys
path "ssh-client-signer/sign/deploy-role" {
  capabilities = ["create", "update"]
}

Admin Policy

# admin.hcl
# Manage secrets engines
path "sys/mounts/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Manage policies
path "sys/policies/acl/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Manage auth methods
path "sys/auth/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# View audit logs
path "sys/audit" {
  capabilities = ["read", "list"]
}

Policy Templates

Using Templating

# Per-user secrets path
path "secret/data/users/{{identity.entity.name}}/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Team-based access
path "secret/data/teams/{{identity.groups.names}}/*" {
  capabilities = ["read", "list"]
}

Policy Management

# Write policy
vault policy write myapp-policy myapp-policy.hcl

# List policies
vault policy list

# Read policy
vault policy read myapp-policy

# Delete policy
vault policy delete myapp-policy

# Test policy (requires root)
vault token create -policy=myapp-policy