How-to: Write a Vault ACL policy for root-like permissions

How To

Summary

Describes how to create an admin level Vault policy.

Steps

Expected Outcome

With this policy, Vault operators can generate tokens with all capabilities on all paths in Vault, including all namespaces.

Use Case

Vault operators often need to generate tokens with root-like like permissions in accordance with the recommended best practice to revoke root tokens immediately after use.

Prerequisites

You will need a token with the ability to write ACL policies. E.g. "create" capabilities on the sys/policies/acl/* path.

Procedure

VAULT UI

Navigate to Policies > ACL Policies > Create ACL Policy
Enter a name for the policy e.g. admin
Paste the following in the Policy field:

path "*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo", "patch", "subscribe", "recover"]
  subscribe_event_types = ["*"]
}

Vault CLI

Create the policy:

tee admin.hcl <<EOF
path "*" {
capabilities = ["create", "read", "update", "delete", "list", "sudo", "patch", "subscribe", "recover"]
subscribe_event_types = ["*"]
}
EOF

Write the policy:

vault policy write admin admin.hcl

Vault API

curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: $(vault print token)" \
-d '{"policy":"path \"*\" {\n capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\", \"sudo\", \"patch\", \"subscribe\", \"recover\"] subscribe_event_types = [\"*\"]\n}\n"}' \
http://127.0.0.1:8200/v1/sys/policies/acl/admin

Additional Information

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSLC9Y2","label":"IBM Vault Self-Managed"},"ARM Category":[{"code":"a8mgJ0000000E4iQAE","label":"Vault-\u003ECore"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"1.14.10;1.14.11;1.14.12;1.14.13;1.14.4;1.14.5;1.14.6;1.14.7;1.14.8;1.14.9;1.15.0;1.15.1;1.15.10;1.15.11;1.15.12;1.15.13;1.15.14;1.15.15;1.15.16;1.15.2;1.15.3;1.15.4;1.15.5;1.15.6;1.15.7;1.15.8;1.15.9;1.16.0;1.16.1;1.16.10;1.16.11;1.16.12;1.16.13;1.16.14;1.16.15;1.16.16;1.16.17;1.16.18;1.16.19;1.16.2;1.16.20;1.16.21;1.16.22;1.16.23;1.16.24;1.16.25;1.16.26;1.16.27;1.16.28;1.16.29;1.16.3;1.16.30;1.16.31;1.16.4;1.16.5;1.16.6;1.16.7;1.16.8;1.16.9;1.17.0;1.17.1;1.17.10;1.17.11;1.17.12;1.17.13;1.17.14;1.17.15;1.17.16;1.17.17;1.17.18;1.17.2;1.17.3;1.17.4;1.17.5;1.17.6;1.17.7;1.17.8;1.17.9;1.18.0;1.18.1;1.18.10;1.18.11;1.18.12;1.18.13;1.18.14;1.18.15;1.18.2;1.18.3;1.18.4;1.18.5;1.18.6;1.18.7;1.18.8;1.18.9;1.19.0;1.19.1;1.19.10;1.19.11;1.19.12;1.19.13;1.19.14;1.19.15;1.19.16;1.19.17;1.19.2;1.19.3;1.19.4;1.19.5;1.19.6;1.19.7;1.19.8;1.19.9;1.20.0;1.20.1;1.20.10;1.20.11;1.20.2;1.20.3;1.20.4;1.20.5;1.20.6;1.20.7;1.20.8;1.20.9;1.21.0;1.21.1;1.21.2;1.21.3;1.21.4;1.21.5;1.21.6;2.0.0;2.0.1;4.2.0-5.4.0"}]

Historical Number

28139861478035

Was this topic helpful?

Document Information

Modified date:
09 June 2026

UID

ibm17264867

Tips