Lutz Finsterle
5e5e7f779f
Reviewable governance scaffolding — NOTHING applied to live OpenBAO yet: - policies/: materialize all existing policies as code (faithfully fetched from live) + new `operator` (use engines, no admin) and `auditor` (read-only governance visibility, no secret material) - scripts/apply-policies.sh: idempotent policy-as-code apply, with a read-only --dry-run that diffs files vs live (ignores comments) - scripts/setup-identity.sh: identity-as-code — policy-bound groups (g-admins/operators/auditors/personal) + a human entity/alias; DEFAULT DRY-RUN, --apply to execute - GOVERNANCE.md: the layered model, policy catalog, naming, apply order, and cross-cutting controls (audit device, root offline, AppRole migration) Dry-runs verified read-only: apply-policies shows operator/auditor as NEW, all others unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
25 lines
1.1 KiB
HCL
25 lines
1.1 KiB
HCL
# auditor — read-only governance visibility. Can see HOW the system is
|
|
# configured and WHO can do what, but CANNOT read any secret material and
|
|
# CANNOT change anything. The independent "governance lens".
|
|
|
|
# Configuration visibility
|
|
path "sys/health" { capabilities = ["read"] }
|
|
path "sys/seal-status" { capabilities = ["read"] }
|
|
path "sys/mounts" { capabilities = ["read"] }
|
|
path "sys/auth" { capabilities = ["read"] }
|
|
path "sys/metrics" { capabilities = ["read"] }
|
|
|
|
# Policy visibility (read the rules, not change them)
|
|
path "sys/policies/acl" { capabilities = ["list"] }
|
|
path "sys/policies/acl/*" { capabilities = ["read"] }
|
|
|
|
# Identity visibility (who exists) — names only, not secrets
|
|
path "identity/entity/name" { capabilities = ["list"] }
|
|
path "identity/group/name" { capabilities = ["list"] }
|
|
|
|
# Audit device configuration visibility (sudo required for this path)
|
|
path "sys/audit" { capabilities = ["read", "sudo"] }
|
|
|
|
# NOTE: intentionally NO `secret/`, `personal/`, `pki*`, `ssh/`, `transit*`
|
|
# data paths — an auditor reviews governance, not secrets.
|