40 lines
2.0 KiB
HCL
40 lines
2.0 KiB
HCL
# Admin policy — broad day-to-day administration WITHOUT being root.
|
|
# Deliberately omits the most dangerous root-only capabilities (sys/raw,
|
|
# generating root tokens, re-keying, raw storage access). Use the root token
|
|
# only for break-glass operations; this policy is for normal admin work.
|
|
|
|
# Manage auth methods
|
|
path "auth/*" { capabilities = ["create", "read", "update", "patch", "delete", "list", "sudo"] }
|
|
path "sys/auth/*" { capabilities = ["create", "read", "update", "delete", "sudo"] }
|
|
path "sys/auth" { capabilities = ["read"] }
|
|
|
|
# Manage ACL policies
|
|
path "sys/policies/acl/*" { capabilities = ["create", "read", "update", "delete", "list"] }
|
|
path "sys/policies/acl" { capabilities = ["list"] }
|
|
|
|
# Manage secrets engines (mount/tune/unmount)
|
|
path "sys/mounts/*" { capabilities = ["create", "read", "update", "delete", "sudo"] }
|
|
path "sys/mounts" { capabilities = ["read"] }
|
|
|
|
# Work with secrets data in mounted engines.
|
|
path "secret/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] }
|
|
path "ssh/*" { capabilities = ["create", "read", "update", "patch", "delete", "list", "sudo"] }
|
|
# NOTE: each secrets engine mounted at a NEW path needs its own rule here
|
|
# (e.g. add `path "pki/*"` when you enable a PKI engine). The UI runs a
|
|
# preflight capability check on the mount path, so a missing rule = 403.
|
|
|
|
# Lease management
|
|
path "sys/leases/*" { capabilities = ["create", "read", "update", "delete", "list", "sudo"] }
|
|
|
|
# Operational visibility
|
|
path "sys/health" { capabilities = ["read", "sudo"] }
|
|
path "sys/seal-status" { capabilities = ["read"] }
|
|
path "sys/mounts/+/tune" { capabilities = ["read", "update"] }
|
|
path "sys/capabilities" { capabilities = ["create", "update"] }
|
|
path "sys/capabilities-self" { capabilities = ["create", "update"] }
|
|
|
|
# Allow token self-management
|
|
path "auth/token/lookup-self" { capabilities = ["read"] }
|
|
path "auth/token/renew-self" { capabilities = ["update"] }
|
|
path "auth/token/revoke-self" { capabilities = ["update"] }
|