HashiCorp Vault Associate (003) Question 56
Single answer2d Choose a Vault policy based on requirementsA security team wants to give a CI/CD system access to application secrets stored in a KV v2 secrets engine mounted at secret/. The pipeline should be able to read only values under secret/data/apps/payments/*, but it must not be able to list other application folders or read metadata outside that path. Which Vault policy best meets this requirement?
- A
path "secret/apps/payments/*" { capabilities = ["read"] }
- B
path "secret/data/apps/payments/*" { capabilities = ["read"] }
- C
path "secret/data/apps/payments/" { capabilities = ["read", "list"] } path "secret/metadata/apps/" { capabilities = ["list"] }
- D
path "secret/*" { capabilities = ["read"] }
Show answer and explanation
Correct answer: B
Explanation
The best choice is the policy that grants only read on the KV v2 data path for the required subtree: secret/data/apps/payments/*. In Vault, KV v2 uses distinct API paths for data and metadata. Policies must match those API paths, not just the user-facing CLI shorthand. Reading secret values requires access to the data endpoint, while listing keys typically involves the metadata endpoint and the list capability. Following least-privilege best practice, you should grant only the minimum capability on the narrowest path needed. This avoids accidental access to sibling application secrets or metadata. This aligns with HashiCorp Vault documentation on ACL policies and KV v2 path structure, especially the distinction between /data/ and /metadata/ endpoints.
- A. Incorrect.
Incorrect. For a KV v2 secrets engine, API paths are versioned internally and policy rules must target the correct API path structure. Reads to secret values use the /data/ prefix, not just the mount path plus the logical secret path. This option reflects a common mistake of writing a KV v1-style policy for a KV v2 engine.
- B. Correct.
Correct. In KV v2, reading secret data requires access to the data endpoint, such as secret/data/apps/payments/config. Granting read on secret/data/apps/payments/* allows the CI/CD system to read secrets only in that subtree. Because no list capability is granted and no metadata path is included, the token cannot list folders or read metadata elsewhere.
- C. Incorrect.
Incorrect. Although the data path is correct for KV v2 reads, this policy also grants list on metadata paths under secret/metadata/apps/*, which would allow the CI/CD system to enumerate application folders. That violates the requirement to avoid listing other application directories or exposing metadata outside the payments path.
- D. Incorrect.
Incorrect. This policy is overly broad. It grants read access across the entire secret mount, not just the payments subtree. It fails the least-privilege requirement and could expose secrets for unrelated applications.