From aac651a5e4a7c5f32b0b7a006a695dcc975d9432 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 6 Aug 2026 23:17:35 +1000 Subject: [PATCH] Grant terraform-infra kv metadata read (#113) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to the merged #111 (which shipped `kv/data/service/terraform/infra` read only). `terraform-infra`'s providers.tf uses a `vault_kv_secret_v2` **data source**, which reads the kv-v2 **metadata** path on every plan/apply (same behaviour that 403'd a prior terraform-git apply — see `policies/kv/service/vault/.../gitea/config_write.yaml`). Add `kv/metadata/service/terraform/infra` read so the plan doesn't 403 once the secret is seeded. Verified against terraform-infra PR #5: `skip_child_token` cleared the child-token 403 and the data-read policy works (plan now reaches "no secret found"); metadata read is the remaining policy gap before a seeded plan can pass. https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/113 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- policies/kv/service/terraform/infra.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/policies/kv/service/terraform/infra.yaml b/policies/kv/service/terraform/infra.yaml index 7524228..a0dd735 100644 --- a/policies/kv/service/terraform/infra.yaml +++ b/policies/kv/service/terraform/infra.yaml @@ -5,6 +5,11 @@ rules: - path: "kv/data/service/terraform/infra" capabilities: - read + # vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2 + # metadata path on every plan/apply; a 403 here fails the plan. + - path: "kv/metadata/service/terraform/infra" + capabilities: + - read auth: approle: