# Write multiple policies but only reads one

**URL:** <https://discuss.hashicorp.com/t/write-multiple-policies-but-only-reads-one/74298>\
**Category:** Vault\
**Tags:** k8s, vault\
**Created:** [April 7, 2025, 11:13pm UTC](https://discuss.hashicorp.com/t/write-multiple-policies-but-only-reads-one/74298 "2025-04-07T23:13:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![todd-dsm](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/todd-dsm/32/8174_2.png) [@todd-dsm](https://discuss.hashicorp.com/u/todd-dsm)\
**Post date:** [April 7, 2025, 11:13pm UTC](https://discuss.hashicorp.com/t/write-multiple-policies-but-only-reads-one/74298/1 "2025-04-07T23:13:33Z")

</div>

I’ve got a weird one during setup: Vault \< (OIDC) \> Keycloak

```auto
Vault v1.18.5
kubectl: Client Version: v1.32.3

```

1. port-forwarded out to the vault service
2. logged into Vault with the root token
3. I have full access via root token - no issues there

After sending the keycloak [policy](https://developer.hashicorp.com/vault/docs/concepts/policies#creating-policies) to vault:

```auto
vault policy write keycloak policy/keycloak-role.hcl

```

Contents of `policy/keycloak-role.hcl`: (referred to later as `policy_lines`)

```hcl
# Mount the OIDC auth method
path "sys/auth/oidc" {
  capabilities = ["create", "read", "update", "delete", "sudo"]
}

# Configure the OIDC auth method
path "auth/oidc/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Write ACL policies
path "sys/policies/acl/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# List available secrets engines to retrieve accessor ID
path "sys/mounts" {
  capabilities = ["read"]
}

```

The only thing that can be read FROM that policy afterwards is:

```auto
% vault policy read keycloak
path "/secret/*" {
    capabilities = ["read", "list"]
}

```

This is not something that was even in `policy/keycloak-role.hcl`.

However, when I wrap the policy in EOF - it totally works:

```auto
% vault policy write keycloak - <<EOF
policy_lines
EOF

```

I can then, re-run the read operation and get ALL of it:

```auto
% vault policy read keycloak
policy_lines

```

> _**Can someone help me understand why the  
> `vault policy write keycloak policy/keycloak-role.hcl` does NOT work but  
> the EOF method does?**_

This is troubling.

_NOTE: I’m still testing policies and assume whatever is above is incorrect until testing is done._

If anyone has keycloak/Vault experience and can comment on that bit, also much appreciated.

---

<div class="post-metadata">

**Author:** ![jonathanfrappier](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jonathanfrappier/32/28004_2.png) [@jonathanfrappier](https://discuss.hashicorp.com/u/jonathanfrappier)\
**Post date:** [April 9, 2025, 12:18pm UTC](https://discuss.hashicorp.com/t/write-multiple-policies-but-only-reads-one/74298/2 "2025-04-09T12:18:11Z")

</div>

I am not able to reproduce this behavior with the example provided.

Are there any existing policies with the same name in your Vault cluster?  
Any policies with the output you weren’t expecting?  
What OS/editor are you using? (Wondering if there is some character issue in the file maybe?)  
Are there other HCL files in the `policy/` directory?

I wrote the provided example to a local file using vi, then wrote the policy to vault.

```auto
vault policy write keycloak keycloak.hcl
Success! Uploaded policy: keycloak

vault policy read keycloak
# Mount the OIDC auth method
path "sys/auth/oidc" {
  capabilities = ["create", "read", "update", "delete", "sudo"]
}

# Configure the OIDC auth method
path "auth/oidc/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Write ACL policies
path "sys/policies/acl/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# List available secrets engines to retrieve accessor ID
path "sys/mounts" {
  capabilities = ["read"]

```

---

<div class="post-metadata">

**Author:** ![todd-dsm](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/todd-dsm/32/8174_2.png) [@todd-dsm](https://discuss.hashicorp.com/u/todd-dsm)\
**Post date:** [April 9, 2025, 6:05pm UTC](https://discuss.hashicorp.com/t/write-multiple-policies-but-only-reads-one/74298/3 "2025-04-09T18:05:21Z")

</div>

Hi Jonathan, starting with easiest to answer:

1. I’m using macOS/VS Code
2. I didn’t see any unexpected policies. I’m starting from scratch so unexpected stuff should stand out.
3. existing policies: Yes, I’m effectively re-running a script that does the same thing, over and over. So, on the first run, no policy at all; on subsequent runs, the expectation would be to overwrite the same policy (of the same name) with the updates included; basic idempotency.
4. Other HCL files in the `policy/` directory: yes. I could double-check; I’ve made that mistake a few times.

* * *

Update: I’ve triple-checked and I think I’m going to run with #4 😑

Thank you for the jr debugging reminder; should have asked myself that question.

---

<div class="post-metadata">

**Author:** ![jonathanfrappier](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jonathanfrappier/32/28004_2.png) [@jonathanfrappier](https://discuss.hashicorp.com/u/jonathanfrappier)\
**Post date:** [April 9, 2025, 7:24pm UTC](https://discuss.hashicorp.com/t/write-multiple-policies-but-only-reads-one/74298/4 "2025-04-09T19:24:48Z")

</div>

Keep us posted on how it turns out! And happy to help - most of us work better as a team - I know I do!

---

<div class="post-metadata">

**Author:** ![todd-dsm](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/todd-dsm/32/8174_2.png) [@todd-dsm](https://discuss.hashicorp.com/u/todd-dsm)\
**Post date:** [April 9, 2025, 10:03pm UTC](https://discuss.hashicorp.com/t/write-multiple-policies-but-only-reads-one/74298/5 "2025-04-09T22:03:05Z")

</div>

I value collaboration above all, even when it’s embarrassing 😆

Thanks again!