HashiCorp Vault Permissions Reference

This section explains the permissions for integrating HashiCorp Vault with SailPoint Entro.

---

Required Permissions

The following ACL configuration enables SailPoint Entro to perform metadata scanning while ensuring no secret content is exposed.

path "*" {
  capabilities = ["list", "read"]
}
path "auth/token/lookup-accessor" {
  capabilities = ["update"]
}
path "auth/token/accessors" {
  capabilities = ["list", "sudo"]
}
path "auth/token/renew-self" {
  capabilities = ["update"]
}

---

Permissions Justification

Path	Capabilities	Purpose
*	list, read	Allows listing and reading metadata for all paths to identify stored secrets
auth/token/lookup-accessor	update	Enables SailPoint Entro to manage its own token session
auth/token/accessors	list, sudo	Required for token accessor visibility and role validation
auth/token/renew-self	update	Allows SailPoint Entro to automatically renew its authentication token

---

KV V2 Metadata-Only Configuration (Optional)

For organizations using KV v2 Secret Engines, you may apply a refined ACL for metadata-only access.

1. List secret engines and their paths

   vault secrets list -detailed | grep -E "^\S+\s+(kv|generic)"
   

2. Create an ACL policy for each listed path

   path "sys/mounts" {
     capabilities = ["read"]
   }
   path "<PATH>/metadata" {
     capabilities = ["list"]
   }
   path "<PATH>/metadata/*" {
     capabilities = ["list", "read"]
   }
   path "sys/auth" {
     capabilities = ["read"]
   }
   path "auth/userpass/users" {
     capabilities = ["list"]
   }
   path "auth/userpass/users/*" {
     capabilities = ["list", "read"]
   }
   path "auth/token/lookup-self" {
     capabilities = ["read"]
   }
   path "auth/token/renew-self" {
     capabilities = ["update"]
   }
   

3. Replace <PATH> with the relevant KV mount path (e.g., secret/).

---