HashiCorp Vault — Policies & ACLs

Policies are the authorization layer in Vault. They define what an authenticated client is allowed to do — which paths they can access and which operations they can perform.

---

What’s in This Chapter?

#	Topic	Description
1	HCL Policy Syntax	Writing policy rules with capabilities
2	Capabilities Deep Dive	create, read, update, delete, list, sudo, deny
3	Policy Examples	Real-world patterns for teams and apps
4	Templated Policies	Dynamic policies with identity variables
5	Policy Management	CRUD, testing, and workflow
6	Practice Exercises	5 hands-on exercises

---

How Policies Work

Client authenticates
       │
       ▼
Token issued with policies: ["dev-team", "default"]
       │
       ▼
Client requests: PUT secret/data/myapp/config
       │
       ▼
Vault checks: Do any attached policies grant
              "create" or "update" on "secret/data/myapp/*"?
       │
       ├── YES → Request allowed
       └── NO  → 403 Permission Denied

Default deny: If no policy explicitly grants access, it is denied.

---

Built-in Policies

Policy	Description	Can Modify?
root	Unlimited access to everything	❌ No
default	Basic token self-management, sys/tools access	✅ Yes

---

Chapter Flow

Start with HCL Policy Syntax to learn how to write policy rules.

---

Next: HCL Policy Syntax