tegwick
3a1bd4f1c8
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
63 lines
2.3 KiB
HCL
63 lines
2.3 KiB
HCL
# secrets-engine-prod — production stage role policy.
|
|
#
|
|
# Scope: apply approved PRODUCTION metadata (ACL policies + approle roles) and
|
|
# write approved lane values for provisioning. Deliberately NARROW:
|
|
# - no root / sudo
|
|
# - no sys/* administration beyond its own se-prod-* ACL policies
|
|
# - no identity/* administration
|
|
# - no auth/token administration
|
|
# - cannot reach into build/ or test/ prefixes
|
|
#
|
|
# Production raw-value READ stays gated: this role can write a value during an
|
|
# approved provisioning step, but broad read of arbitrary prod paths is denied.
|
|
# Consumers read their own lane through the narrow se-prod-<lane> consumer policy.
|
|
|
|
# Apply approved production lane values (provisioning) and metadata.
|
|
# Owner-scoped prod lanes (e.g. whynot-design/...) — NOT under build/ or test/.
|
|
path "secret/data/+/*" {
|
|
capabilities = ["create", "update", "patch"]
|
|
}
|
|
path "secret/metadata/+/*" {
|
|
capabilities = ["create", "read", "update", "list"]
|
|
}
|
|
|
|
# Manage only the prod consumer policies this role owns.
|
|
path "sys/policies/acl/se-prod-*" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
# Exact exception for SECRETS-WP-0004 auth-capability lane.
|
|
path "sys/policies/acl/warden-sign" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
# Manage prod approle roles only.
|
|
path "auth/approle/role/se-prod-*" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
path "auth/approle/role/se-prod-*/role-id" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "auth/approle/role/se-prod-*/secret-id" {
|
|
capabilities = ["create", "update"]
|
|
}
|
|
|
|
# Exact exception for SECRETS-WP-0004 auth-capability lane.
|
|
path "auth/approle/role/warden-sign" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
path "auth/approle/role/warden-sign/role-id" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "auth/approle/role/warden-sign/secret-id" {
|
|
capabilities = ["create", "update"]
|
|
}
|
|
|
|
# Hard denials — production appliers must not become broad admins.
|
|
path "secret/data/build/*" { capabilities = ["deny"] }
|
|
path "secret/data/test/*" { capabilities = ["deny"] }
|
|
path "sys/policies/acl/secrets-engine-*" { capabilities = ["deny"] } # can't edit stage roles
|
|
path "auth/token/*" { capabilities = ["deny"] }
|
|
path "identity/*" { capabilities = ["deny"] }
|
|
path "sys/auth/*" { capabilities = ["deny"] }
|
|
path "sys/mounts/*" { capabilities = ["deny"] }
|