ACL plus notation does not work in path

Vault
, ,
1

Hello,

I have kv v1 with foo/ path and want to create policy for deny specific secrets inside foo/+/, in my case foo/+/bitbucket*.

But for some reason this policy below does not work. I’m still able to read any secrets in foo/+/bitbucket* with bitbucket* prefix.

path "foo/+" {
  capabilities = ["list"]
}

path "foo/bar/*" {
  capabilities = ["list", "read", "create", "update", "patch", "delete"]
}

path "foo/+/bitbucket*" {
  capabilities = ["deny"]
}

It working only when I explicitly specificy full path like this:

path "foo/bar/bitbucket*" {
  capabilities = ["deny"]
}

Why + does not work in my case?

Thanks.

2

Needs to be changed to:

path "foo/+/" {
  capabilities = ["list"]
}

The handling of trailing slashes with list operations and + wildcards is inconsistent with the same if + wildcards are not used, unfortunately.

3

Sorry but this does not allow to list any path under foo/. Moreover it does not solve issue with:

path "foo/bar/bitbucket*" {
  capabilities = ["deny"]
}
4

Seems like this kind of ACL just don’t work with kv v1. I checked same patterns with kv v2 and it works perfectly.