terraform-vault/policies/sshca/sshca_signhost.hcl

path "sshca/sign/host" {
  capabilities = ["create", "update"]
}