HashiCorp Vault Associate (003) Question 38
Single answer2 Vault policiesA platform team uses Vault KV v2 at the path secret/ to store application credentials. Developers in the payments team should be able to read only the current value of secrets under secret/data/payments/*, but they must not be able to view metadata, list secret names, read older versions, or permanently delete or destroy data. Which Vault policy best meets this requirement?
- A
path "secret/data/payments/*" { capabilities = ["read"] }
- B
path "secret/payments/*" { capabilities = ["read"] }
- C
path "secret/data/payments/" { capabilities = ["read", "list"] } path "secret/metadata/payments/" { capabilities = ["read"] }
- D
path "secret/data/payments/" { capabilities = ["create", "update", "read"] } path "secret/delete/payments/" { capabilities = ["update"] }
Show answer and explanation
Correct answer: A
Explanation
The best answer is the policy that grants only read on the KV v2 data path: secret/data/payments/*. For KV v2, policy paths must match the underlying API paths, not just the mount path. Common KV v2 endpoints include /data/ for reading and writing secret values, /metadata/ for listing and metadata operations, /delete/ for soft-deleting versions, /undelete/ for restoring versions, and /destroy/ for permanently removing version data. Following Vault least-privilege best practices, you should grant only the specific capability and path needed. In this case, developers need to read current values only, so read on the data path is sufficient and avoids unnecessary access to metadata or destructive operations. This aligns with HashiCorp Vault documentation for KV secrets engine v2 and Vault ACL policy behavior.
- A. Correct.
Correct. In KV v2, reading secret data uses the /data/ endpoint, so granting read on secret/data/payments/* allows users to read the current secret values. Because the policy does not grant access to secret/metadata/, secret/delete/, secret/undelete/, or secret/destroy/, users cannot list secret names, inspect metadata, soft-delete versions, undelete, or permanently destroy data. This matches the least-privilege requirement.
- B. Incorrect.
Incorrect. This path format is a common mistake caused by confusing KV v1 and KV v2. For KV v2, API paths for secret values include /data/, while metadata operations use /metadata/. A policy on secret/payments/* would not correctly grant access to the KV v2 data endpoint.
- C. Incorrect.
Incorrect. Adding list and metadata access violates the requirement. In KV v2, listing keys is performed against the metadata path, and granting access related to metadata increases visibility into secret names and version information. Even if the intent is to help users browse secrets, this exceeds the requested permissions.
- D. Incorrect.
Incorrect. This policy grants write capabilities (create and update) in addition to read, which is more privilege than required. It also grants access to the delete endpoint, allowing users to soft-delete versions. The scenario explicitly states they should only read current values and should not delete or destroy data.