HashiCorp Vault policy for create/delete namespace

user_4440766 0
Viewed 207

In the /org/teams/my-team I have configured an AppRole. I'd like to grant my AppRole permission to create and delete namespaces underneath my my-team namespace.

How will the policy look like for this case?

I can achieve the desired with

path "*" {
    capabilities = ["create", "delete"]
}

but of course, this is too powerful.

I could not find anything helpful in the official HashiCorp docs.

hashicorp-vault
1 Answers

The general policy path for namespaces is at sys/namespaces. You can confirm this with the API endpoints for namespaces. Your policy would appear like:

path "sys/namespaces" {
  capabilities = ["list"]
}

path "sys/namespaces/my-team" {
  capabilities = ["list", "read"]
}

path "sys/namespaces/my-team/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}
user_53433870
Related