foundation/packages/pulumi-vault/policy.ts

export const adminPolicyContent = `
# Manage auth methods broadly across Vault
path "auth/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Create, update, and delete auth methods
path "sys/auth/*" {
  capabilities = ["create", "update", "delete", "sudo"]
}

# List auth methods
path "sys/auth" {
  capabilities = ["read"]
}

# Create and manage ACL policies
path "sys/policies/acl/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# List ACL policies
path "sys/policies/acl" {
  capabilities = ["list"]
}

# Create and manage secrets engines broadly across Vault.
path "sys/mounts/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# List enabled secrets engines
path "sys/mounts" {
  capabilities = ["read", "list"]
}

# List, create, update, and delete key/value secrets at secret/
path "secret/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Manage transit secrets engine
path "transit/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Read health checks
path "sys/health" {
  capabilities = ["read", "sudo"]
}

path "*/metadata" {
  capabilities = ["create", "update", "read", "delete",  "list"]
}

path "*/metadata/*" {
  capabilities = ["create", "update", "read", "delete",  "list"]
}

path "*/data" {
  capabilities = ["create", "update", "read", "delete",  "list"]
}

path "*/data/*" {
  capabilities = ["create", "update", "read", "delete",  "list"]
}

path "*" {
  capabilities = ["create", "update", "read", "delete",  "list"]
}

`;