允许用户更新/删除某些策略（Hashicorp Vault）

Question

说明我使用的是HashiCorp的保险库，版本1.7.0，免费版本。

{
capabilities = ["list"]
}

#To show the identity endpoint from the UI
path "/identity/*"{
 capabilities = ["list" ]
}

#policies that I would like the user to have the ability to #assign to the group.

path "/sys/policies/acl/it_team_leader"{
capabilities = ["read", "update", "list"]
}

path "sys/policies/acl/it_user"{
capabilities = ["read", "update","list"]
}

path "sys/policies/acl/ui_settings"{
capabilities = ["read", "update", "list"]
}

path "sys/policies/acl/personal_storage"{
capabilities = ["read", "update","list"]
}

#Group id that the user have full access

path "/identity/group/id/2c97485a-754f-657a-5a8b-62b08a3ce8cb" {

capabilities = ["sudo","read","update","create","list"]
}

path "sys/policies/acl/**super-priveleged**" {
capabilities = ["deny"]
}

用allowed_parameters追加组路径，如：

capabilities = ["sudo","read","update","create","list"]
denied_parameters = {
"policies" = ["it_user","it_team_leader",etc]

}

我收到一个权限拒绝错误（403）。附加被拒绝的参数：

path "/identity/group/id/2c97485a-754f-657a-5a8b-62b08a3ce8cb" {

capabilities = ["sudo","read","update","create","list"]
denied_parameters = {
"policies" = ["super-policy"]

}

不起作用，我仍然被允许分配超级策略。

我也尝试了通配符，结果相同。

是否有可能限制可以从Vault UI分配的一个/一个策略范围？

如果你到目前为止已经成功了，请提前感谢。

Answer 1

找到了解决方案，为了限制用户更新某些策略，允许的参数字段应该封装一个列表，并添加一个带有空列表的星号键。

注意：从UI分配的策略的顺序应该符合。hcl文件中写入的顺序。

path "/identity/group/id/2c97485a-754f-657a-5a8b-62b08a3ce8cb"
{

capabilities = ["sudo","read","update","create","list"]
allowed_parameters = {
"policies" = [["policy1","policy2","policy3"]]
"*" = []
}
}