HashiCorp Vault Associate (003) Question 54
Single answer2c Describe Vault policy syntax: capabilitiesA platform team is creating a Vault policy for an application that stores API keys at the path secret/data/payments. The application must be able to read the current secret value and update that same secret, but it must not be allowed to delete versions, destroy metadata, or list other secrets. Which policy stanza best meets these requirements?
- A
path "secret/data/payments" { capabilities = ["read", "update"] }
- B
path "secret/data/payments" { capabilities = ["create", "read", "delete"] }
- C
path "secret/*" { capabilities = ["read", "update", "list"] }
- D
path "secret/metadata/payments" { capabilities = ["read", "update"] }
Show answer and explanation
Correct answer: A
Explanation
Vault policies use path stanzas with capabilities to control what operations a token can perform. Common capabilities include create, read, update, delete, list, sudo, patch, and deny. In this scenario, the key applied concept is mapping the intended action to the correct capability and the correct API path. For KV v2, secret values are accessed under the data endpoint, while metadata operations use the metadata endpoint. To read the current value and modify the same secret without allowing broader actions, the least-privilege policy is capabilities = ["read", "update"] on path "secret/data/payments". This aligns with Vault policy best practices: grant only the minimum capabilities necessary and avoid wildcard paths or extra capabilities such as list or delete unless explicitly required.
- A. Correct.
Correct. For KV v2, reading and writing secret data occurs on the /data/ path. The read capability allows the application to retrieve the current secret, and update allows it to write a new value to an existing secret path. This satisfies the requirement without granting delete or list access.
- B. Incorrect.
Incorrect. Although create can be useful when initially writing a secret, this option omits update, which is needed to modify an existing secret value. It also grants delete, which violates the requirement that the application must not be allowed to delete versions or secret data.
- C. Incorrect.
Incorrect. This is overly broad because it grants access to all paths under secret/*, not just the payments secret. It also includes list, which the scenario explicitly forbids. A common mistake is using a wildcard path that gives more access than required.
- D. Incorrect.
Incorrect. In KV v2, the /metadata/ path is used for metadata operations such as listing or managing version metadata, not for reading or writing the actual secret value. Granting capabilities on secret/metadata/payments would not allow the application to read or update the secret data at secret/data/payments.