How do I figure out what policy I need to add from a 403 response?

Question

I send a HTTP request to my Hashicorp Vault instance and receive a 403 HTTP response. How do I reverse engineer the policy I need to add from my request path?

curl \
-v \
-H "X-Vault-Token: $VAULT_TOKEN" \
https://myvault/v1/sys/plugins/catalog

< HTTP/2 403 
< date: Tue, 18 May 2021 20:52:52 GMT
< content-type: application/json
< content-length: 60
< cache-control: no-store
< strict-transport-security: max-age=15724800; includeSubDomains
< 
{"errors":["1 error occurred:\n\t* permission denied\n\n"]}

score 0 · Answer 1 · answered May 21 '21 at 02:15

The Hashicorp vault does not suggest or show any error which permission is missing. Instead, you can have a more generic and even it's easy most of the time to set the permission if you look at the pattern or the way it's set.

In your case, I can see you are trying to perform a GET request to the path /sys/plugins/catalog and is getting 403.

so, you can have in the policy like this

path "sys/plugins/catalog" {
  capabilities = ["read"]
}

The GET request is of the capability type read, you can read more about these here.

How do I figure out what policy I need to add from a 403 response?

1 Answers1