Secrets Access Control

Controlling who can access which secrets.

Access control enforcement is deployment-specific. This repo does not ship a complete policy engine for the permission strings shown below.

Permission model

Secret-level permissions

• vault:secrets:read - Read secret value
• vault:secrets:write - Create/update secrets
• vault:secrets:delete - Delete secrets
• vault:secrets:rotate - Trigger rotation

Path-based policies

These resource strings are logical policy patterns (often based on secret names), not Vault API paths or secret IDs.

{
  "statements": [
    {
      "effect": "allow",
      "actions": ["vault:secrets:read"],
      "resources": ["secrets/production/*"]
    },
    {
      "effect": "deny",
      "actions": ["vault:secrets:*"],
      "resources": ["secrets/production/root-*"]
    }
  ]
}

Access patterns

Role-based

{
  "role": "developer",
  "secrets": {
    "development/*": ["read"],
    "staging/*": ["read"],
    "production/*": []
  }
}

Service-based

{
  "service": "payment-service",
  "secrets": {
    "secrets/stripe-*": ["read"],
    "secrets/db-payment": ["read"]
  }
}

Conditions

Time-based

{
  "conditions": {
    "time": {
      "after": "09:00",
      "before": "18:00",
      "timezone": "UTC"
    }
  }
}

IP-based

{
  "conditions": {
    "sourceIp": ["10.0.0.0/8", "192.168.1.0/24"]
  }
}

Emergency access

Break-glass procedures:

1. Request emergency access
2. Approval from multiple admins
3. Time-limited access granted
4. Full audit trail