The error was thrown because the policy code contains an invalid capability, “write”. The valid

capabilities for a policy are “create”, “read”, “update”, “delete”, “list”, and “sudo”. The “write”

capability is not recognized by Vault and should be replaced with “create”, which allows creating new

secrets or overwriting existing ones. The other statements are not correct, because the wildcard (*)

and the sudo capability are both valid in a policy. The wildcard matches any number of characters

within a path segment, and the sudo capability allows performing certain operations that require

root privileges.

Reference:

[Policy Syntax | Vault | HashiCorp Developer]

[Policy Syntax | Vault | HashiCorp Developer]

This policy would allow read permissions for all secrets at path secret/bar, as well as list permissions

for the secret/bar/ path. The list permission is required to be able to see the names of the secrets

under a given path1. The wildcard () character matches any number of characters within a single path

segment, while the slash (/) character matches the end of the path2. Therefore, the policy would

grant read access to any secret that starts with secret/bar/, such as secret/bar/foo or secret/bar/baz,

but not to secret/bar itself. To grant list access to secret/bar, the policy needs to specify the exact

path with a slash at the end. This policy follows the principle of least privilege, which means that it

only grants the minimum permissions necessary for the users to perform their tasks3.

The other options are not correct because they either grant too much or too little permissions.

Option A would grant both read and list permissions to all secrets under secret/bar, which is more

than what is required. Option B would grant list permissions to all secrets under secret/bar, but only

read permissions to secret/bar itself, which is not what is required. Option D would use an invalid

character (+) in the policy, which would cause an error.

Reference:

Policy Syntax | Vault | HashiCorp Developer

Policy Syntax | Vault | HashiCorp Developer

Policies | Vault | HashiCorp Developer

Shamir’s Secret Sharing is a cryptographic algorithm that allows a secret to be split into multiple

parts, called key shares, such that a certain number of key shares are required to reconstruct the

secret. The number of key shares and the threshold number are configurable parameters that

depend on the desired level of security and availability. Vault uses Shamir’s Secret Sharing to protect

its master key, which is used to encrypt and decrypt the data encryption key that secures the Vault

data. When Vault is initialized, it generates a master key and splits it into a configured number of key

shares, which are then distributed to trusted operators. To unseal Vault, the threshold number of key

shares must be provided to reconstruct the master key and decrypt the data encryption key. This

process ensures that no single operator can access the Vault data without the cooperation of other

key holders. Reference: https://developer.hashicorp.com/vault/docs/concepts/seal4,

https://developer.hashicorp.com/vault/docs/commands/operator/init5,

https://developer.hashicorp.com/vault/docs/commands/operator/unseal6

A web application that uses Vault’s transit secrets engine to encrypt data in-transit can benefit from

the following security features:

Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in

transit). This means that the attacker would need to obtain the encryption key from Vault in order to

decrypt the data, which is protected by Vault’s authentication and authorization mechanisms. The

transit secrets engine does not store the data sent to it, so the attacker cannot access the data from

Vault either.

The keys can be rotated and min_decryption_version moved forward to ensure this data cannot be

decrypted. This means that the web application can periodically change the encryption key used to

encrypt the data, and set a minimum decryption version for the key, which prevents older versions of

the key from being used to decrypt the data. This way, even if the attacker somehow obtained an old

version of the key, they would not be able to decrypt the data that was encrypted with a newer

version of the key.

The other statements are not true, because:

You cannot rotate the encryption key so that the attacker won’t be able to decrypt the data. Rotating

the key alone does not prevent the attacker from decrypting the data, as they may still have access to

the old version of the key that was used to encrypt the data. You need to also move the

min_decryption_version forward to invalidate the old version of the key.

The Vault administrator would not need to seal the Vault server immediately. Sealing the Vault server

would make it inaccessible to both the attacker and the legitimate users, and would require

unsealing it with the unseal keys or the recovery keys. Sealing the Vault server is a last resort option

in case of a severe compromise or emergency, and is not necessary in this scenario, as the attacker

does not have access to the encryption key or the data in Vault. Reference: Transit - Secrets Engines |

Vault | HashiCorp Developer, Encryption as a service: transit secrets engine | Vault | HashiCorp

Developer

The Vault’s auth method component is the component that performs authentication and assigns

identity and policies to a client. It verifies a client against an internal or external system, and

generates a token with the appropriate policies attached. The token can then be used to access the

secrets and resources that are authorized by the policies. Vault supports various auth methods, such

as userpass, ldap, aws, kubernetes, etc., that can integrate with different identity providers and

systems. The auth method component can also handle token renewal and revocation, as well as

identity grouping and aliasing. Reference: Auth Methods | Vault | HashiCorp

Developer, Authentication - Concepts | Vault | HashiCorp Developer