HashiCorp Vault Associate (003) Question 59
Single answer2d Choose a Vault policy based on requirementsA platform team uses Vault KV v2 at the path secret/ to store application configuration. A new CI pipeline for the payments service must be able to read only the current value of the secret at secret/data/payments/api and update that same secret when rotating credentials. The pipeline must not be able to delete versions, destroy versions, or read secret metadata for other paths. Which Vault policy best meets these requirements?
- A
path "secret/data/payments/api" { capabilities = ["read", "update"] }
- B
path "secret/payments/api" { capabilities = ["read", "update"] }
- C
path "secret/data/payments/" { capabilities = ["create", "read", "update", "delete"] } path "secret/metadata/payments/" { capabilities = ["read"] }
- D
path "secret/data/*" { capabilities = ["read"] } path "secret/metadata/payments/api" { capabilities = ["update"] }
Show answer and explanation
Correct answer: A
Explanation
The best policy is the one that follows KV v2 path conventions and the principle of least privilege. In Vault KV v2, secret data is accessed through paths like
- A. Correct.
Correct. For KV v2, reads and writes to secret values use the /data/ endpoint, so the policy must target secret/data/payments/api rather than the mount root path alone. Granting read allows the pipeline to fetch the current version of the secret, and update allows it to write a new version to that exact path. This policy does not grant delete, destroy, or metadata access, which matches the stated least-privilege requirement.
- B. Incorrect.
Incorrect. This is a common mistake caused by confusing KV v1 and KV v2 paths. In KV v2, ACL policies for secret values must reference the API path that includes /data/, such as secret/data/payments/api. A policy on secret/payments/api will not grant the intended access to the secret data endpoint.
- C. Incorrect.
Incorrect. Although this policy would allow reading and writing under the payments subtree, it is broader than required and grants unnecessary permissions. The delete capability on the data path is not needed here, and read access to secret/metadata/payments/* explicitly allows metadata access, which the requirement says should not be granted. It also covers multiple paths instead of only the single secret path needed by the pipeline.
- D. Incorrect.
Incorrect. This policy is both overbroad and functionally wrong for the requirement. Granting read on secret/data/* allows reading all secrets under the mount, not just the payments API secret. Also, updating secret metadata is not how a client writes new secret values in KV v2; secret values are written to the /data/ endpoint, while metadata operations use different endpoints and are not needed for this use case.