HashiCorp Vault — Policy Examples

3 minute read

Real-world Vault policies for common team structures and application patterns.

Admin Policy (Full Access)

# admin-policy.hcl
# Full access to everything except root-only operations

# Manage secrets engines
path "sys/mounts/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Manage auth methods
path "sys/auth/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Manage policies
path "sys/policies/acl/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# List policies
path "sys/policies/acl" {
  capabilities = ["list"]
}

# Read system health
path "sys/health" {
  capabilities = ["read", "sudo"]
}

# Manage audit devices
path "sys/audit/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# All secrets
path "secret/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Manage identity
path "identity/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

Developer Team Policy

# dev-team-policy.hcl
# Read/write access to team secrets, read-only for shared

# Team secrets — full CRUD
path "secret/data/dev-team/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
path "secret/metadata/dev-team/*" {
  capabilities = ["list", "read", "delete"]
}

# Shared secrets — read only
path "secret/data/shared/*" {
  capabilities = ["read"]
}
path "secret/metadata/shared/*" {
  capabilities = ["list", "read"]
}

# Transit encryption for the dev key
path "transit/encrypt/dev-key" {
  capabilities = ["update"]
}
path "transit/decrypt/dev-key" {
  capabilities = ["update"]
}

# PKI — issue certificates
path "pki/issue/dev-team" {
  capabilities = ["create", "update"]
}

Application Read-Only Policy

# app-read-policy.hcl
# Application reads secrets at runtime — no write access

path "secret/data/apps//*" {
  capabilities = ["read"]
}

path "secret/metadata/apps//*" {
  capabilities = ["list"]
}

# Read database credentials
path "database/creds/app-readonly" {
  capabilities = ["read"]
}

CI/CD Pipeline Policy

# ci-cd-policy.hcl
# Read secrets, push to deploy

# Read application configuration
path "secret/data/ci/*" {
  capabilities = ["read", "list"]
}
path "secret/metadata/ci/*" {
  capabilities = ["list", "read"]
}

# Generate dynamic database credentials
path "database/creds/ci-deploy" {
  capabilities = ["read"]
}

# Sign artifacts with Transit
path "transit/sign/ci-signing-key" {
  capabilities = ["update"]
}

# Issue short-lived TLS certs for deployment
path "pki/issue/ci-deploy" {
  capabilities = ["create", "update"]
}

Operations / SRE Policy

# ops-policy.hcl
# Read everything, manage infrastructure secrets

# Read all secrets
path "secret/data/*" {
  capabilities = ["read", "list"]
}
path "secret/metadata/*" {
  capabilities = ["list", "read"]
}

# Write infrastructure secrets
path "secret/data/infra/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
path "secret/metadata/infra/*" {
  capabilities = ["list", "read", "delete"]
}

# Manage dynamic secrets
path "database/config/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
path "database/roles/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
path "database/creds/*" {
  capabilities = ["read"]
}

# View audit logs
path "sys/audit" {
  capabilities = ["read", "list"]
}

# View system health
path "sys/health" {
  capabilities = ["read"]
}

# Manage leases
path "sys/leases/lookup/*" {
  capabilities = ["read", "list"]
}
path "sys/leases/revoke" {
  capabilities = ["update"]
}

Emergency Break-Glass Policy

# break-glass-policy.hcl
# Emergency read access to everything
# Assign with short TTL, audit heavily

path "*" {
  capabilities = ["read", "list"]
}

# But never allow destructive operations
path "sys/seal" {
  capabilities = ["deny"]
}
path "sys/step-down" {
  capabilities = ["deny"]
}

Multi-Tenant Pattern

# tenant-a-policy.hcl
# Tenant A can only see their own secrets

path "secret/data/tenants/tenant-a/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
path "secret/metadata/tenants/tenant-a/*" {
  capabilities = ["list", "read"]
}

# Explicitly deny other tenant paths
path "secret/data/tenants/tenant-b/*" {
  capabilities = ["deny"]
}
path "secret/data/tenants/tenant-c/*" {
  capabilities = ["deny"]
}

Quick Reference

Policy Pattern Use Case
Team-scoped paths (team/*) Department isolation
App-scoped paths with templates Per-application secrets
Read-only policies Applications at runtime
CI/CD policies Build/deploy pipelines
deny on sensitive paths Guardrails
Break-glass policies Emergency access
Tenant isolation Multi-tenant SaaS

Next: Templated Policies

You may also enjoy