A CI controller's token carries only the ci-controller policy and has no sudo. For every build, the controller must create a token that carries the ci-build policy, which its own token does not have, and no build token may live longer than 1 hour. Which approach works?
ARun vault token create -policy=ci-build -explicit-max-ttl=1h with the controller's token
BRun vault token create -policy=ci-build -ttl=1h -orphan with the controller's token
CDefine a token role with allowed_policies=ci-build and token_explicit_max_ttl=1h, and create build tokens against it
DDefine a token role with allowed_policies=ci-build and token_ttl=1h, and create build tokens against it
Show the answer and why
ARun vault token create -policy=ci-build -explicit-max-ttl=1h with the controller's token
Incorrect
Without a role, a new token may only carry policies its creator already has, unless the creator is root or holds sudo.
BRun vault token create -policy=ci-build -ttl=1h -orphan with the controller's token
Incorrect
Creating an orphan this way needs sudo, and the policy is still outside the creator's set.
CDefine a token role with allowed_policies=ci-build and token_explicit_max_ttl=1h, and create build tokens against it
Correct
Role-based creation allows the policies the role lists instead of only the caller's.
DDefine a token role with allowed_policies=ci-build and token_ttl=1h, and create build tokens against it
Incorrect
token_ttl is only the initial TTL; renewable tokens can be renewed up to the mount or system max, far beyond an hour.
Token roles let a less privileged creator issue tokens with a fixed set of policies and limits, without sudo.
A build controller creates tokens against the token role builds. Its own token carries the policies ci-read, ci-write and prod-admin. Build tokens may carry any of the controller's policies except prod-admin. Which role setting enforces this?
Aallowed_policies=prod-admin
Btoken_no_default_policy=true
Cdisallowed_policies=prod-admin
Drenewable=false
Show the answer and why
Aallowed_policies=prod-admin
Incorrect
This would let tokens from the role carry only prod-admin, the opposite of the goal.
Btoken_no_default_policy=true
Incorrect
This only keeps the default policy off the tokens.
Cdisallowed_policies=prod-admin
Correct
Token creation through the role then fails whenever prod-admin is requested, while other policies follow the normal rules.
Drenewable=false
Incorrect
This only stops renewal past the initial TTL; it does not restrict policies.
A disallowed list blocks the named policies while the creator can still hand out the rest of its own policies through the role.
An operator whose token carries the policies default, ops and audit runs vault token create with no -policy flag and no role. Which policies does the new token carry?
AOnly default, the policy every new token receives
BNone; the command fails until a -policy flag is given
CThe root policy, since no restriction was given
DThe operator's own policies: default, ops and audit
Show the answer and why
AOnly default, the policy every new token receives
Incorrect
default is added to new tokens, but without -policy the token also gets its creator's other policies.
BNone; the command fails until a -policy flag is given
Incorrect
-policy is optional; without it the token inherits its creator's policies.
CThe root policy, since no restriction was given
Incorrect
A new token gets root only when its creator is itself a root token; leaving out -policy widens nothing.
DThe operator's own policies: default, ops and audit
Correct
A created token inherits all policies of the authenticated token unless a list of policies is given.
Name the policies explicitly when creating tokens for others, so they do not inherit everything their creator can do.