Using "denied_parameters" on Vault Token auth method (API) to deny token for specific policy when capabilities contain sudo

Vault
1

Hi Everyone!

Is it possible to give a policy-token sudo rights for creating new tokens and thereby denying a specific policy? Saying it can create a token for all existing policies expect a specific one called here admin_super?

We tried the following policy but unfortunately its not working…

path “auth/token/create” {
capabilities = [“create”, “update”, “delete”, “sudo”]
denied_parameters = {
“policies” = [“admin_super”]
}
}

when creating a token based on this policy, the token is still able to create an admin_super token via
$ vault token create -policy=admin_super -ttl=50h …

Thanks and all the best!

1 Like
2

The *_parameters parameters only work against string values, they get ignored for lists, objects, maps, etc.

If you’re an enterprise customer, then Sentinel would be the way to go to achieve your goal.

3

Thanks for the feedback!!