48 lines
1.9 KiB
HCL
48 lines
1.9 KiB
HCL
|
# secrets-engine-prod — production stage role policy.
|
||
|
|
#
|
||
|
|
# Scope: apply approved PRODUCTION metadata (ACL policies + approle roles) and
|
||
|
|
# write approved lane values for provisioning. Deliberately NARROW:
|
||
|
|
# - no root / sudo
|
||
|
|
# - no sys/* administration beyond its own se-prod-* ACL policies
|
||
|
|
# - no identity/* administration
|
||
|
|
# - no auth/token administration
|
||
|
|
# - cannot reach into build/ or test/ prefixes
|
||
|
|
#
|
||
|
|
# Production raw-value READ stays gated: this role can write a value during an
|
||
|
|
# approved provisioning step, but broad read of arbitrary prod paths is denied.
|
||
|
|
# Consumers read their own lane through the narrow se-prod-<lane> consumer policy.
|
||
|
|
|
||
|
|
# Apply approved production lane values (provisioning) and metadata.
|
||
|
|
# Owner-scoped prod lanes (e.g. whynot-design/...) — NOT under build/ or test/.
|
||
|
|
path "secret/data/+/*" {
|
||
|
|
capabilities = ["create", "update"]
|
||
|
|
}
|
||
|
|
path "secret/metadata/+/*" {
|
||
|
|
capabilities = ["create", "read", "update", "list"]
|
||
|
|
}
|
||
|
|
|
||
|
|
# Manage only the prod consumer policies this role owns.
|
||
|
|
path "sys/policies/acl/se-prod-*" {
|
||
|
|
capabilities = ["create", "read", "update", "delete"]
|
||
|
|
}
|
||
|
|
|
||
|
|
# Manage prod approle roles only.
|
||
|
|
path "auth/approle/role/se-prod-*" {
|
||
|
|
capabilities = ["create", "read", "update", "delete"]
|
||
|
|
}
|
||
|
|
path "auth/approle/role/se-prod-*/role-id" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
path "auth/approle/role/se-prod-*/secret-id" {
|
||
|
|
capabilities = ["create", "update"]
|
||
|
|
}
|
||
|
|
|
||
|
|
# Hard denials — production appliers must not become broad admins.
|
||
|
|
path "secret/data/build/*" { capabilities = ["deny"] }
|
||
|
|
path "secret/data/test/*" { capabilities = ["deny"] }
|
||
|
|
path "sys/policies/acl/secrets-engine-*" { capabilities = ["deny"] } # can't edit stage roles
|
||
|
|
path "auth/token/*" { capabilities = ["deny"] }
|
||
|
|
path "identity/*" { capabilities = ["deny"] }
|
||
|
|
path "sys/auth/*" { capabilities = ["deny"] }
|
||
|
|
path "sys/mounts/*" { capabilities = ["deny"] }
|