Vault policies use path-based syntax with wildcards (+ for one segment, * for zero or more) to define permissions. The policy path "secret/+/training/*" { capabilities = ["create", "read"] } grants "create" and "read" access to paths matching this pattern.
Path Analysis:
The + wildcard matches exactly one segment after "secret/".
"training/" must follow that segment.
The * wildcard allows any number of subsequent segments (including none).
Correct Paths:
B. secret/cloud/training/test/exam: Matches as "cloud" fits +, followed by "training/", and "test/exam" fits *. "Permitted since + allows for cloud and * allows for test/exam."
D. secret/departments/training/vault: Matches with "departments" as +, "training/", and "vault" as *. "Permitted since + allows for departments and vault is in place of *."
Incorrect Paths:
A. secret/business/training: Fails because there’s no trailing segment after "training/" to match *. "Not permitted since the wildcard is AFTER training."
C. secret/departments/certification/api: Fails because "certification" replaces "training/", which is required. "Not permitted since certification does not equal training."
This policy targets paths with a specific structure, ensuring precise access control.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit