required policy ?
rockandska opened this issue · comments
Hi,
I create a policy dedicated for my needs with :
path "secret/*" { capabilities = ["read","list"] }
and works as expected with CLI
But when using a token bind to this policy I hit the error bellow
$ ./medusa export secret -m kv1 -a https://127.0.0.1:8200 -k -t xxxxxxxxxxxxxxxxxxxxxxxxxxxx
Error making API request.
URL: GET https://127.0.0.1:8200/v1/sys/internal/ui/mounts/secret
Code: 403. Errors:
* permission denied
I don't get why medusa needs to access v1/sys/internal/ui/mounts/secret
for looping over what is in secret
.
Regards,
Hi @rockandska
What version of Vault are you using?
There is actually a good reason for this. Please have a look at #70 to read the explanation for this need.
An old one @jonasvinther : 0.9.5
Not sure I get all the reason in #70 but my token works in CLI with the policy shown above.
Adding a minimal policy example in the README for a readonly user would be nice
Thanks