Task 2.5: Configure Vault policies using the UI and CLI

• Avault policy write app.hcl app-read, then vault token capabilities <token> secret/data/app/config

  Incorrect

  The name comes first and the file second, so this uploads a policy called app.hcl from a file named app-read.

• Bvault policy fmt app.hcl, then vault policy read app-read

  Incorrect

  fmt only rewrites the file in canonical format and uploads nothing, and the second command does not report a token's access.

• Cvault policy write app-read app.hcl, then vault token capabilities <token> secret/data/app/config

  Correct

  policy write takes the name, then the file; token capabilities lists the token's capabilities on a path.

• Dvault policy write app-read app.hcl, then vault token lookup <token>

  Incorrect

  token lookup shows a token's properties and policy names, not its capabilities on a path.

Upload with vault policy write <name> <file>; check effective access with vault token capabilities, which accepts a token or uses the current one.

• Avault policy read

  Incorrect

  This does not list the names of the stored policies.

• Bvault token capabilities

  Incorrect

  This command is about one token, not the stored policies.

• Cvault secrets list

  Incorrect

  This lists enabled secrets engines.

• Dvault policy list

  Correct

  policy list prints the names of the installed policies.

vault policy wraps the sys/policy endpoints: list, read, write, delete and fmt.

• AUnder Secrets engines, by writing the policy as a KV secret named after it

  Incorrect

  Policies are not KV secrets; the UI has its own policy section.

• BIn the UI's policy section: write the policy in the editor or upload an HCL file

  Correct

  The UI creates ACL policies in its own policy section, written directly or uploaded as an HCL file.

• CNowhere, because the UI cannot create or edit policies

  Incorrect

  The UI supports creating policies directly or uploading HCL.

• DUnder the token's profile menu, by attaching capabilities to the current token

  Incorrect

  Capabilities are granted through named policies, not set on a token in the UI.

Whichever interface is used, keep policies as code in version control so the UI is not the only copy.

• ARun it again with the -output-policy flag added

  Correct

  -output-policy builds a minimal policy that grants what the command needs.

• Bvault policy fmt on the developer's current policy

  Incorrect

  fmt only reformats a policy file.

• Cvault token lookup on the developer's token

  Incorrect

  lookup shows token properties and policy names, not what a command needs.

• Dvault path-help kv/secret

  Incorrect

  path-help explains an endpoint; it does not produce a policy.

-output-policy is the quickest way to draft least-privilege policies for CLI workflows.

• APOST /v1/sys/policies/acl with {"name": "app-read", "file": "./policies/app.hcl"}

  Incorrect

  The name is part of the path, and the server cannot read a client's file.

• BPOST /v1/auth/token/policies/app-read with {"policy": "<HCL>"}

  Incorrect

  Policies are managed under sys/, not under the token method.

• CPOST /v1/sys/policies/acl/app-read with {"policy": "<the HCL as a string>"}

  Correct

  The ACL policy endpoint takes the policy document as a string in the policy field.

• DGET /v1/sys/policies/acl/app-read with the HCL as a query string

  Incorrect

  GET reads a policy; creating one is a write.

Escape the HCL into a JSON string first, for example with jq, then post it to sys/policies/acl/<name> or the older sys/policy/<name>.