From 6e7a052293f499eed7e6d8236c05919c3c0b66a2 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 6 Aug 2026 23:09:13 +1000 Subject: [PATCH] Grant terraform-infra kv metadata read vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2 metadata path on every plan/apply; add read on kv/metadata/service/terraform/infra so the plan doesn't 403 (same pattern as the terraform-git gitea config policy). Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --- policies/kv/service/terraform/infra.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/policies/kv/service/terraform/infra.yaml b/policies/kv/service/terraform/infra.yaml index 7524228..cc6663e 100644 --- a/policies/kv/service/terraform/infra.yaml +++ b/policies/kv/service/terraform/infra.yaml @@ -5,6 +5,11 @@ rules: - path: "kv/data/service/terraform/infra" capabilities: - read + # vault_kv_secret_v2 (providers.tf data source) reads the kv-v2 metadata path + # on every plan/apply; a 403 here fails the plan. + - path: "kv/metadata/service/terraform/infra" + capabilities: + - read auth: approle: