HashiCorp Vault Associate (003) Question 233
Single answer9 Access management architectureA platform team is designing access management for HashiCorp Vault across multiple business units. They want application teams to authenticate with their existing identity provider, receive only the permissions required for their own secrets paths, and make it easy to change access centrally when people move teams. The security team also wants to avoid creating and managing many local Vault users. Which approach best fits these requirements?
- A
Enable an external auth method such as OIDC, LDAP, or userpass for each team, create separate local Vault users for every person, and attach policies directly to those users
- B
Use an external identity auth method, map authenticated users or groups into Vault Identity entities and groups, and attach policies to Vault groups so access can be managed through group membership
- C
Create one shared token per business unit with broad policies attached, distribute the token to all team members, and rotate it monthly
- D
Store team membership in ACL policies by creating separate policy documents for each individual user and updating those policies whenever a person changes roles
Show answer and explanation
Correct answer: B
Explanation
The best answer is to authenticate users with an external identity source and manage authorization through Vault Identity entities and groups. In Vault, auth methods verify who a caller is, while policies define what that caller can do. Vault Identity provides a way to unify identities from one or more auth methods and assign policies through internal or external groups. This architecture is preferred when organizations want centralized lifecycle management, minimal local user administration, and scalable least-privilege access.
This reflects core Vault design guidance: use auth methods such as OIDC or LDAP to integrate with existing identity systems, then attach policies to groups rather than to large numbers of individual users or shared tokens. Group-based access also simplifies audits and role changes. Relevant HashiCorp documentation includes Vault concepts for authentication, ACL policies, and the Identity secrets engine concepts around entities, aliases, and groups.
- A. Incorrect.
Incorrect. While external auth methods are appropriate, creating separate local Vault users for every person works against the requirement to avoid managing many local users. Attaching policies directly to individual users does not scale well and makes role changes harder to manage centrally. Vault best practice is generally to integrate with an external identity source and use identity groups rather than managing per-user access manually inside Vault.
- B. Correct.
Correct. This design aligns with Vault access management architecture best practices. Users authenticate through a supported external auth method, Vault creates or links Identity entities, and access is granted through Identity groups with policies attached to those groups. This supports least privilege, reduces local user management, and makes access changes easier because group membership can be updated centrally rather than rewriting individual policies.
- C. Incorrect.
Incorrect. Sharing a token among multiple users is a poor security practice because it removes user-level accountability, complicates auditing, and usually grants more access than necessary. Tokens should represent a specific authenticated identity or workload, not a whole department of people sharing credentials.
- D. Incorrect.
Incorrect. ACL policies define permissions on paths, but they are not intended to be the source of truth for user-to-team membership. Encoding team membership by maintaining separate policies per user creates administrative overhead and increases the risk of inconsistent access. Group-based identity mapping is the more scalable model.