Lutz Finsterle
5e5e7f779f
Reviewable governance scaffolding — NOTHING applied to live OpenBAO yet: - policies/: materialize all existing policies as code (faithfully fetched from live) + new `operator` (use engines, no admin) and `auditor` (read-only governance visibility, no secret material) - scripts/apply-policies.sh: idempotent policy-as-code apply, with a read-only --dry-run that diffs files vs live (ignores comments) - scripts/setup-identity.sh: identity-as-code — policy-bound groups (g-admins/operators/auditors/personal) + a human entity/alias; DEFAULT DRY-RUN, --apply to execute - GOVERNANCE.md: the layered model, policy catalog, naming, apply order, and cross-cutting controls (audit device, root offline, AppRole migration) Dry-runs verified read-only: apply-policies shows operator/auditor as NEW, all others unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
34 lines
1.5 KiB
HCL
34 lines
1.5 KiB
HCL
# operator — day-to-day USE of secrets engines, but NO administration.
|
|
# Deliberately cannot manage mounts, auth methods, policies, or identity, and
|
|
# has no access to the personal/ or transit-personal/ trust domains. This is
|
|
# the policy a human should hold for routine work instead of full `admin`.
|
|
|
|
# KV v2 data (shared secrets)
|
|
path "secret/data/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] }
|
|
path "secret/metadata/*" { capabilities = ["read", "list", "delete"] }
|
|
|
|
# PKI: issue/sign leaf certs (NOT manage the CA)
|
|
path "pki_int/issue/*" { capabilities = ["update"] }
|
|
path "pki_int/sign/*" { capabilities = ["update"] }
|
|
path "pki/issue/*" { capabilities = ["update"] }
|
|
|
|
# SSH: sign user/host certs (NOT manage the CA or roles)
|
|
path "ssh/sign/*" { capabilities = ["update"] }
|
|
|
|
# Transit: use existing keys (NOT create/rotate/delete)
|
|
path "transit/encrypt/*" { capabilities = ["update"] }
|
|
path "transit/decrypt/*" { capabilities = ["update"] }
|
|
|
|
# TOTP codes
|
|
path "totp/code/*" { capabilities = ["create", "read", "update"] }
|
|
|
|
# Read-only operational visibility
|
|
path "sys/mounts" { capabilities = ["read"] }
|
|
path "sys/health" { capabilities = ["read"] }
|
|
path "sys/seal-status" { capabilities = ["read"] }
|
|
|
|
# Token self-management
|
|
path "auth/token/lookup-self" { capabilities = ["read"] }
|
|
path "auth/token/renew-self" { capabilities = ["update"] }
|
|
path "auth/token/revoke-self" { capabilities = ["update"] }
|