25 lines
713 B
HCL
25 lines
713 B
HCL
# Managed by vault-foundation. The database runner may reconcile only the named
|
|
# PostgreSQL connection, dynamic role, and minimal self-service token endpoints.
|
|
|
|
path "database/config/auth-system-postgres-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "database/roles/auth-db-migration-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
# no-default-policy runner tokens retain only the self-service operations used
|
|
# for capability checks, identity verification, and explicit revocation.
|
|
path "sys/capabilities-self" {
|
|
capabilities = ["update"]
|
|
}
|
|
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/revoke-self" {
|
|
capabilities = ["update"]
|
|
}
|