Implement Dynamic Policies in Vault

Contributed by: Prachi Jain

Difficulty level: Intermediate

HashiCorp Vault’s dynamic policies offer a flexible way to create policies that adapt based on user-specific metadata and contextual data. This ability to adapt allows you to define access permissions dynamically, granting specific capabilities based on the entity or parameters like names, ids, roles, namespaces, and paths.

Prerequisites

You will need to do the following to get started:

• Be sure that helm is installed on your system:

  helm version --short

  If it is installed, you will see a version displayed. If helm is not installed, you can find instructions based on your system in the official Helm documentation.

• Verify that minikube is installed:

  minikube version

  If minikube is not installed, you can use the instructions provided in the official Kubernetes documentation to install it. If you already have a Kubernetes cluster running, you can use that instead of minikube.

Dynamic Policies

In this section, we will enable the userpass auth method, create a user, entity, and alias, and write a templated policy for the user which will be dynamically evaluated during runtime.

1. Enable userpass auth method:

   vault auth enable userpass
   Success! Enabled userpass auth method at: userpass/

2. Create a new user, alice:

   vault write auth/userpass/users/alice password=shortcut-demo policies=dynamic-user-policy
   Success! Data written to: auth/userpass/users/alice

3. Log in with the username, ...