We are using GitHub teams to allocate policies to users.
On logging in via the vault cli I can see the policies associated with my user. On the whole these look correct, however I also see one application specific policy foo-app. How can I debug why that application specific policy is associated with my user?
N.B. It’s possible that in the past that the foo-app policy was associated with my user account, but the vault policies have since been updated. Does vault “remember” these historical associations?
My GitHub team policy is admin
- type: github
config:
organization: Busuu
map:
teams:
AWS: default,webui-helper,admin
The admin policy:
- name: admin
rules: |
path "sys/*" {
capabilities = ["list", "read", "delete"]
}
path "static/*" {
capabilities = ["list", "create", "read", "update", "delete"]
}
path "static/metadata" {
capabilities = ["list"]
}
path "sys/internal/ui/mounts/static" {
capabilities = ["create", "read", "update", "delete", "sudo"]
}
path "static/data/*" {
capabilities = ["create", "read", "update", "delete", "sudo"]
}
path "database/creds/*" {
capabilities = ["read"]
}
# These are to allow for manual OIDC setup
path "sys/auth/oidc" {
capabilities = ["create", "read", "update", "delete", "sudo"]
}
path "auth/oidc/*" {
capabilities = ["list", "create", "read", "update", "delete"]
}
# Full access to policies
# List existing policies
path "sys/policies/acl"
{
capabilities = ["list"]
}
# Create and manage ACL policies
path "sys/policies/acl/*"
{
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}
# Enable and manage authentication methods broadly across Vault
# Manage auth methods broadly across Vault
path "auth/*"
{
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}
# Create, update, and delete auth methods
path "sys/auth/*"
{
capabilities = ["create", "update", "delete", "sudo"]
}
# List auth methods
path "sys/auth"
{
capabilities = ["read"]
}
The foo-app policy:
- name: foo-app
rules: |
path "static/data/ateam/foo-app" {
capabilities = ["list", "read"]
}
The problem is I’m able to edit secrets under:
ateam/bar-app/
But I only have read-access to:
ateam/foo-app/
