From f5a18325b6e276994eca19c27ca64809a168b3e9 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 6 Aug 2026 23:12:27 +1000 Subject: [PATCH] Grant terraform-infra kv metadata read vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2 metadata path on every plan/apply once the secret is seeded; grant read on kv/metadata/service/terraform/infra so the plan doesn't 403 (mirrors the terraform-git gitea config policy pattern). Follow-up to the merged #111 which shipped data-read only. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --- policies/kv/service/terraform/infra.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/policies/kv/service/terraform/infra.yaml b/policies/kv/service/terraform/infra.yaml index 7524228..a0dd735 100644 --- a/policies/kv/service/terraform/infra.yaml +++ b/policies/kv/service/terraform/infra.yaml @@ -5,6 +5,11 @@ rules: - path: "kv/data/service/terraform/infra" capabilities: - read + # vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2 + # metadata path on every plan/apply; a 403 here fails the plan. + - path: "kv/metadata/service/terraform/infra" + capabilities: + - read auth: approle: -- 2.47.3