solovyovk · October 5, 2021 18:14 · Feb 1, 2019 · Sep 7, 2017 · Sep 7, 2017 · Sep 7, 2017
diff --git a/Terraform.hcl b/Terraform.hcl
@@ -0,0 +1,14 @@
+resource "vault_policy" "example" {
+  name   = "basic"
+  policy = "${file("policies/basic.hcl")}"
+}
+
+# contents of basic.hcl
+path "sys/renew/*" {
+    capabilities = ["update"]
+}
+
+# Allow renewal of token leases
+path "auth/token/renew/*" {
+    capabilities = ["update"]
+}
diff --git a/HashiCorp Vault - methods of writing ACL policies b/HashiCorp Vault - methods of writing ACL policies
@@ -1 +1,11 @@
-There are many methods for writing Vault policies, I've just used this gist to collect the most common methods such that they can be easily used as references for syntax, as well as evaluation for which method suits a particular purpose.
+There are many methods for writing Vault policies. 
+
+This gist was created to collect the most common methods 
+such that they can be easily used as references for syntax, 
+as well as evaluation for which method suits a particular purpose.
+
+TODO:
+
+- Add complex policy examples
+- Add @json.file examples
+- Add httpie examples
diff --git a/HashiCorp Vault - methods of writing ACL policies b/HashiCorp Vault - methods of writing ACL policies
@@ -0,0 +1 @@
+There are many methods for writing Vault policies, I've just used this gist to collect the most common methods such that they can be easily used as references for syntax, as well as evaluation for which method suits a particular purpose.
diff --git a/Using Curl - JSON body b/Using Curl - JSON body
@@ -0,0 +1,15 @@
+curl \
+    --silent \
+    --header "X-Vault-Token: root" \
+    --request POST \
+    --data '{"rules":"path \"secret/foo\" {\n capabilities = [\"list\",\"read\"]\n} \npath \"supersecret/*\" {\n capabilities = [\"list\", \"read\"]\n} \npath \"auth/token/lookup-self\" {\n capabilities = [\"read\"]\n}"}' \
+    http://127.0.0.1:8200/v1/sys/policy/test
+
+
+# read back policy
+curl \
+    --silent \
+    --header "X-Vault-Token: root" \
+    --request GET \
+    http://127.0.0.1:8200/v1/sys/policy/test | jq '.rules'
+"path \"secret/foo\" {\n capabilities = [\"list\",\"read\"]\n} \npath \"supersecret/*\" {\n capabilities = [\"list\", \"read\"]\n} \npath \"auth/token/lookup-self\" {\n capabilities = [\"read\"]\n}"
diff --git a/Using Vault CLI - using stdin b/Using Vault CLI - using stdin
@@ -0,0 +1,24 @@
+echo '
+path "secret/foo" {
+  capabilities = ["list","read"]
+}
+path "supersecret/*" {
+  capabilities = ["list", "read"]
+}
+path "auth/token/lookup-self" {
+  capabilities = ["create", "read"]
+}
+' | vault policy-write user -
+
+## read policy back
+#$ vault policies user
+
+path "secret/foo" {
+  capabilities = ["list","read"]
+}
+path "supersecret/*" {
+  capabilities = ["list", "read"]
+}
+path "auth/token/lookup-self" {
+  capabilities = ["create", "read"]
+}
diff --git a/Using Vault CLI - write using HCL file b/Using Vault CLI - write using HCL file
@@ -0,0 +1,56 @@
+echo '
+path "secret/foo" {
+  capabilities = ["list","read"]
+}
+path "supersecret/*" {
+  capabilities = ["list", "read"]
+}
+path "auth/token/lookup-self" {
+  capabilities = ["create", "read"]
+}
+' > policy.hcl
+
+vault policy-write test2 policy.hcl
+####################################################
+# read back policy
+#$ vault policies test2
+
+path "secret/foo" {
+  capabilities = ["list","read"]
+}
+path "supersecret/*" {
+  capabilities = ["list", "read"]
+}
+path "auth/token/lookup-self" {
+  capabilities = ["create", "read"]
+}
+
+####################################################
+vault read -format=json sys/policy/test2
+{
+	"request_id": "dae10a3f-1334-9cb9-df2e-4571d32c6530",
+	"lease_id": "",
+	"lease_duration": 0,
+	"renewable": false,
+	"data": {
+		"name": "test2",
+		"rules": "\npath \"secret/foo\" {\n  capabilities = [\"list\",\"read\"]\n}\npath \"supersecret/*\" {\n  capabilities = [\"list\", \"read\"]\n}\npath \"auth/token/lookup-self\" {\n  capabilities = [\"create\", \"read\"]\n}\n\n"
+	},
+	"warnings": null
+}
+
+
+####################################################
+vault read sys/policy/test2
+Key  	Value
+---  	-----
+name 	test2
+rules	path "secret/foo" {
+  capabilities = ["list","read"]
+}
+path "supersecret/*" {
+  capabilities = ["list", "read"]
+}
+path "auth/token/lookup-self" {
+  capabilities = ["create", "read"]
+}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		There are many methods for writing Vault policies, I've just used this gist to collect the most common methods such that they can be easily used as references for syntax, as well as evaluation for which method suits a particular purpose.
No results found