Policy to match multiple directories in the middle

Vault
,
1

I have a requirement to “deny” access to vault path like PATH/****/SOME_PATH/*****/*SOMESUFFIX

Expectation is to block all the below paths:
PATH/one/two/three/SOME_PATH/four/five/sixSOMESUFFIX
PATH/one/two/SOME_PATH/four/sixSOMESUFFIX

I have created a policies like below for that

path "PATH/*/SOME_PATH/*/*SOMESUFFIX" {
  capabilities = ["deny"]
}

But this doesn’t block the access.

Even I tried the below policy (Based on suggestion from Grok that “**” will match multiple directories)

path "PATH/**/SOME_PATH/**/*SOMESUFFIX" {
  capabilities = ["deny"]
}

Any help to fix any issue in my policy

2

Hello @cravi53 ,
Vault does not support using * in the middle of the path; it should only be used as the last character. This link maybe can help you.

With that being said, you can trying using the + to match the common suffix, something like this: path/+/some-path/* or path/+/+/some-path/* . It cannot be used as part of a directory, like path/test+/some-path . This will not work.

You could try using: path/+/some-path/+/secret-name

Let me know if it helps you