# Policies when creating vault roles via cli vs terraform

**URL:** <https://discuss.hashicorp.com/t/policies-when-creating-vault-roles-via-cli-vs-terraform/48173>\
**Category:** Vault\
**Tags:** vault\
**Created:** [December 20, 2022, 2:43pm UTC](https://discuss.hashicorp.com/t/policies-when-creating-vault-roles-via-cli-vs-terraform/48173 "2022-12-20T14:43:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pantelis-karamolegko](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/pantelis-karamolegko/32/9919_2.png) [@pantelis-karamolegko](https://discuss.hashicorp.com/u/pantelis-karamolegko)\
**Post date:** [December 20, 2022, 2:43pm UTC](https://discuss.hashicorp.com/t/policies-when-creating-vault-roles-via-cli-vs-terraform/48173/1 "2022-12-20T14:43:52Z")

</div>

When creating an oidc role in `vault` cli, you can do the following:

```auto
vault write auth/oidc/role/default-role \
    user_claim="sub" \
    bound_audiences=$CLIENT_ID \
    allowed_redirect_uris="https://my-vault-url/ui/vault/auth/oidc/oidc/callback" \
    allowed_redirect_uris="http://localhost:8250/oidc/callback" \
    policies=policy-deny \
    ttl=1h
Success! Data written to: auth/oidc/role/default-role

```

However, in the corresponding terraform [resource](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/jwt_auth_backend_role), there is no (plain) `policies` attribute, just a `token_policies`

Why is that?

---

<div class="post-metadata">

**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\
**Post date:** [December 20, 2022, 4:20pm UTC](https://discuss.hashicorp.com/t/policies-when-creating-vault-roles-via-cli-vs-terraform/48173/2 "2022-12-20T16:20:44Z")

</div>

```auto
$ vault path-help auth/oidc/role/some-name-here
...
## PARAMETERS
...
    policies (slice)

        (DEPRECATED) Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used.
...
    token_policies (slice)

        Comma-separated list of policies
...

```

`policies` is the deprecated old name, kept for compatibility. `token_policies` is the new canonical name of the option.

In the extreme olden days of Vault (Vault 0.7 !), policies were always assigned to tokens.

Then the Identity system came along in 0.8 / 0.9, and it became desirable to clarify policies applied via tokens, and policies applied via the identity system. So many options got renamed to `token_policies`. But the old naming is still supported, though deprecated, to prevent inconveniencing users with existing scripts.