{"id":20645484,"url":"https://github.com/leboncoin/vault-manager","last_synced_at":"2025-04-16T02:11:55.428Z","repository":{"id":32667684,"uuid":"138744244","full_name":"leboncoin/vault-manager","owner":"leboncoin","description":"CLI tool to keep Vault configuration into files","archived":false,"fork":false,"pushed_at":"2025-01-19T00:19:21.000Z","size":161,"stargazers_count":9,"open_issues_count":2,"forks_count":7,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-04-16T02:11:35.634Z","etag":null,"topics":["cli","config","hashicorp-vault","leboncoin","manager","pyhon","vault"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/leboncoin.png","metadata":{"files":{"readme":"README.md","changelog":"ChangeLog","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-06-26T13:45:25.000Z","updated_at":"2025-01-24T10:04:42.000Z","dependencies_parsed_at":"2022-08-07T18:00:29.962Z","dependency_job_id":null,"html_url":"https://github.com/leboncoin/vault-manager","commit_stats":null,"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leboncoin%2Fvault-manager","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leboncoin%2Fvault-manager/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leboncoin%2Fvault-manager/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leboncoin%2Fvault-manager/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/leboncoin","download_url":"https://codeload.github.com/leboncoin/vault-manager/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249183106,"owners_count":21226142,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","config","hashicorp-vault","leboncoin","manager","pyhon","vault"],"created_at":"2024-11-16T16:20:02.962Z","updated_at":"2025-04-16T02:11:55.411Z","avatar_url":"https://github.com/leboncoin.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# vault-manager\n\nvault-manager is a CLI which allows to keep all your Hashicorp Vault configuration in a directory.\n\n## How does it works\n\nvault-manager is a CLI which use modules to interact with Vault.\nEach module is and should be designed to interact woth a Vault part ('policies' module allows to manage policies, 'auth' module allows to manage authentication methods etc...)\n\n## Installation and usage\n\n### Using pip\n\n#### Prerequisite\n\nvault-manager has been developed using python 3.6.5 and works fine with this version.\nSome modules may not work using python 2.\n\nBe sure there's a pypi source containing vaultmanager setup on your computer\n\n#### Installation\n\n```bash\n$\u003e pip install vaultmanager\n```\n\n**And you're now ready to go !**\n\n### From source\n\n#### Prerequisite\n\nvault-manager has been developed using python 3.6.5 and works fine with this version.\nSome modules may not work using python 2.\n\nvault-manager is using [pbr](https://pypi.org/project/pbr/) to build its package.\nFirst, you need to install pbr\n\n```bash\n$\u003e pip install pbr\n```\n\n### Installation\n\nOnce pbr installed, you'll be able to create the python package\n\n```bash\n$\u003e python setup.py sdist\n```\n\nthis will create the python package in a newly created `dist` folder in the project root folder.\n\nYou can now install the python package\n\n```bash\npip install dist/vaultmanager-2.0.0.tar.gz\n```\n\n**And you're now ready to go !**\n\n## How to use it\n\nOnce the vaultmanager installed, you can now use the following command\n\n```bash\n$\u003e vault-manager -h\nusage: vault-manager [-h] [-V] [-v] [-d] [-s] [--vault-addr [VAULT_ADDR]]\n                     [--vault-target-addr [VAULT_TARGET_ADDR]] [--vault-token]\n                     [--vault-target-token] [--vault-config [VAULT_CONFIG]]\n                     {ldap,policies,kv} ...\n\nVault configuration manager\n\npositional arguments:\n  {ldap,policies,kv}\n    ldap                ldap management\n    policies            policies management\n    kv                  kv management\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -V, --version         display version and exit\n  -v, --verbose         enable verbose mode\n  -d, --dry-run         run in dry mode: No API calls\n  -s, --skip-tls        disable TLS verification\n  --vault-addr [VAULT_ADDR]\n                        Vault address (https://\u003cURL\u003e:\u003cPORT\u003e)\n  --vault-target-addr [VAULT_TARGET_ADDR]\n                        Vault target address (https://\u003cURL\u003e:\u003cPORT\u003e)\n  --vault-token         Prompt for Vault token\n  --vault-target-token  Prompt for Vault target token\n  --vault-config [VAULT_CONFIG]\n                        Specify location of vault_config folder\n```\n\nYou can print the help for each module by typing\n\n```bash\nvault-manager \u003cmodule\u003e -h\n```\n\nEach module can be run with `--dry-run`, `--verbose` or `--skip-tls` args\n\nArgument -v, --verbose is quantitative:\n* no `-v` flag will produce a standard output with an `INFO` log level\n* `-v` flag enhance the log output but stays in `INFO` level\n* `-vv` flag enhance the log output comparing to `-v` and change the log level to `DEBUG` \n\ne.g.\n\n```bash\n$\u003e vault-manager -vv -d -s ldap --list-groups\n```\n\n## Modules\n\nThere's 3 vaultmanager modules:\n* **kv**: K/V store management. Contains different operations on the Vault K/V store\n* **ldap**: LDAP management. Allows to create groups/users Vault policies from a LDAP and configure them into Vault\n* **policies**: Vault policies management. Allows to push/pull policies created with `ldap` module from/to Vault instance\n\nFor each **Needed arguments** sections below, arguments can be specified in two ways:\n* as a command line argument\n* as an environment variable\n\nHere is the correspondence table:\n\n| Command line argument | Environment variable |\n|-----------------------|----------------------|\n| --vault-addr          | VAULT_ADDR           |\n| --vault-target-addr   | VAULT_TARGET_ADDR    |\n| --vault-token         | VAULT_TOKEN          |\n| --vault-target-token  | VAULT_TARGET_TOKEN   |\n| --vault-config        | VAULT_CONFIG         |\n\nIf `--vault-token` or `--vault-target` are present, you will be prompted for tokens\n\n## kv\n\n**kv** modules allows to perform actions on the key/value store\n\n```bash\n$\u003e vault-manager kv -h\nusage: vault-manager kv [-h] [--copy-path COPY_FROM_PATH COPY_TO_PATH]\n                        [--copy-secret SECRET_TO_COPY SECRET_TARGET]\n                        [--delete PATHS_TO_DELETE [PATHS_TO_DELETE ...]]\n                        [--count SECRET_PATHS [SECRET_PATHS ...]]\n                        [--find-duplicates SECRET_PATHS [SECRET_PATHS ...]]\n                        [--secrets-tree SECRET_PATHS [SECRET_PATHS ...]]\n                        [-e SECRET_PATHS [SECRET_PATHS ...]]\n                        [--generate-tree SECRET_PATHS [SECRET_PATHS ...]]\n                        [--depth [DEPTH]]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  --copy-path COPY_FROM_PATH COPY_TO_PATH\n                        copy kv store from specified path COPY_FROM_PATH from\n                        $VAULT_ADDR instance to $VAULT_TARGET_ADDR at path\n                        COPY_TO_PATH. $VAULT_TOKEN is used for $VAULT_ADDR and\n                        $VAULT_TARGET_TOKEN is used for $VAULT_TARGET_ADDR\n  --copy-secret SECRET_TO_COPY SECRET_TARGET\n                        copy one secret from $VAULT_ADDR instance at\n                        SECRET_TO_COPY to $VAULT_TARGET_ADDR at SECRET_TARGET\n  --delete PATHS_TO_DELETE [PATHS_TO_DELETE ...]\n                        delete PATH_TO_DELETE and all secrets under it from\n                        $VAULT_ADDR instance. $VAULT_TOKEN is used for\n                        $VAULT_ADDR\n  --count SECRET_PATHS [SECRET_PATHS ...]\n                        count all secrets on $VAULT_ADDR instance under\n                        SECRET_PATHS\n  --find-duplicates SECRET_PATHS [SECRET_PATHS ...]\n                        search and display duplicates on $VAULT_ADDR instance\n                        under SECRET_PATHS\n  --secrets-tree SECRET_PATHS [SECRET_PATHS ...]\n                        display all secrets tree (path/to/secret:key) on\n                        $VAULT_ADDR instance under SECRET_PATHS\n  -e SECRET_PATHS [SECRET_PATHS ...], --exclude SECRET_PATHS [SECRET_PATHS ...]\n                        paths to excludes from count, find-duplicates or\n                        secrets-tree\n  --generate-tree SECRET_PATHS [SECRET_PATHS ...]\n                        paths under which will be generated a random secrets\n                        tree\n  --depth [DEPTH]       depth of tree generated by generate-tree\n```\n\n### Configuration file\n\nThere is no configuration file needed by this module\n\n#### --copy-path\n\n`vault-manager kv --copy-path COPY_FROM_PATH COPY_TO_PATH`\n\n##### Arguments needed\n\n* vault-addr\n* vault-target-addr\n* vault-token\n* vault-target-token\n\n**copy-path** will copy k/v tree at COPY_FROM_PATH to COPY_TO_PATH.\n\n**copy-path** should be used only to copy secrets folders. To copy a single secret instead, use **copy-secret**\n\nAll secrets under `COPY_FROM_PATH` on `vault-addr` will be copied to `COPY_TO_PATH` on `vault-target-addr`. (`vault-addr` and `vault-target-addr` can be identical if you want to duplicate a secret tree on the same Vault instance)\n\n##### Example\n\nwith the following command\n\n`vault-manager kv --copy-path path/to/tree path/to/new-tree`\n\nThe secret `path/to/tree/this/is/secret` will be copied at `path/to/new-tree/this/is/secret`\n\n**WARNING:** All secrets already existing on `vault-target-addr` will be overwritten\n\n**NOTE:** Secrets already existing on `vault-target-addr` but not existing on `vault-addr` will not be deleted\n\n#### --copy-secret\n\n`vault-manager kv --copy-secret SECRET_TO_COPY SECRET_TARGET`\n\n##### Arguments needed\n\n* vault-addr\n* vault-target-addr\n* vault-token\n* vault-target-token\n\n##### Description\n\n**copy-secret** will copy a single secret at `SECRET_TO_COPY` to `SECRET_TARGET`.\n\n**copy-secret** should be used only to copy single secrets. To copy a path instead, use `--copy-path`\n\nAll secrets under `COPY_FROM_PATH` on `vault-addr` will be copied to `COPY_TO_PATH` on `vault-target-addr`. (`vault-addr` and `vault-target-addr` can be identical if you want to duplicate a secret tree on the same Vault instance)\n\n##### Example\n\nwith the following command\n\n`vault-manager kv --copy-secret this/is/secret this/is/new-secret`\n\nThe secret `this/is/secret` will be copied at `this/is/new-secret`\n\n**WARNING:** The secret already existing on `vault-target-addr` will be overwritten\n\n#### --delete\n\n`vault-manager kv --delete PATHS_TO_DELETE [PATHS_TO_DELETE ...]`\n\n##### Arguments needed\n\n* vault-addr\n* vault-target-addr\n* vault-token\n* vault-target-token\n\n##### Description\n\n**delete** will delete all secrets at and under each path of `PATHS_TO_DELETE` on `vault-addr`\n\n**WARNING:** All secrets at and under `PATH_TO_DELETE` will be deleted and it will not be possible to recover them\n\n#### --count\n\n`vault-manager kv --count SECRET_PATHS [SECRET_PATHS ...] --exclude SECRET_PATHS [SECRET_PATHS ...]`\n\n##### Arguments needed\n\n* vault-addr\n* vault-token\n\n##### Description\n\nThis command will count all secrets under each path of `SECRET_PATHS`\n\nIf one or several path(s) is/are specified after `--exclude`, these paths will be excluded from the count\n\n##### Example\n \n```bash\n$\u003e vault-manager kv --count services apps\n{\n    \"services\": {\n        \"secrets_count\": 5,\n        \"values_count\": 6\n    },\n    \"apps\": {\n        \"secrets_count\": 5,\n        \"values_count\": 8\n    }\n}\n```\n\n#### --find-duplicates\n\n`vault-manager kv --find-duplicates SECRET_PATHS [SECRET_PATHS ...] --exclude SECRET_PATHS [SECRET_PATHS ...]`\n\n##### Arguments needed\n\n* vault-addr\n* vault-token\n\n##### Description\n\nThis command will look for each secret value under `SECRET_PATHS` and will try to find a duplicated value of this value \n\nThe output is a dictionary of duplicate's groups\n\n##### Example\n\n```bash\n$\u003e vault-manager kv --find-duplicates services apps\n{\n    \"0\": [\n        \"apps/path/to/secret:key\",\n        \"services/another/path/anothersecret:otherkey\"\n    ],\n    \"1\": [\n        \"apps/hello/credentials:username\",\n        \"apps/accounts/user1:password\"\n    ]\n}\n```\n\nThis means:\n * The value of the secret `apps/path/to/secret` at key `key` is the same than the secret `services/another/path/anothersecret` at the key `otherkey`\n * The value of the secret `apps/hello/credentials` at key `username` is the same than the secret `apps/accounts/user1` at the key `password`\n\n\n#### --secrets-tree\n\n`vault-manager kv --secrets-tree SECRET_PATHS [SECRET_PATHS ...] --exclude SECRET_PATHS [SECRET_PATHS ...]`\n\n##### Arguments needed\n\n* vault-addr\n* vault-token\n\n##### Description\n\nThis command will display all secrets paths under `SECRET_PATHS`\n\nThe output is a dictionary of lists grouped by root path\n\n##### Example\n\n```bash\n$\u003e vault-manager kv --secrets-tree services apps\n{\n    \"services\": [\n        \"services/prod/ldap/accounts/svc-vault\",\n        \"services/tree/alsoin/newpath/newsecret\",\n        \"services/tree/alsoin/services/secret1\",\n        \"services/tree/directsecret\",\n        \"services/tree/in/services/secret\"\n    ],\n    \"apps\": [\n        \"apps/app1/credentials\",\n        \"apps/credentials\",\n        \"apps/app2/username\"\n    ]\n}\n```\n\n#### --generate-tree\n\n`vault-manager kv --generate-tree SECRET_PATHS [SECRET_PATHS ...] --depth [DEPTH]`\n\n##### Arguments needed\n\n* vault-addr\n* vault-token\n\n##### Description\n\nThis command will generate a random secrets tree under `SECRET_PATHS` using words in `/usr/share/dict/words`\n\n**WARNING**: This command can take a long time if you specify a high depth (\u003e4)\n\n##### Example\n\n```bash\n$\u003e vault-manager kv --generate-tree apps --depth 2\nWill create 1 secrets and 2 folders under 'apps'\nWill create 5 secrets and 0 folders under 'apps/Laburnum'\nWill create 5 secrets and 0 folders under 'apps/valeric'\n```\n\n## ldap\n\n**ldap** module is in charge of interacting with your LDAP contacts\n\n```bash\n$\u003e vault-manager ldap -h\nusage: cli.py ldap [-h] [--list-groups] [--create-policies]\n                   [--manage-ldap-groups [LDAP_mount_point]]\n                   [--manage-ldap-users [LDAP_mount_point]]\n                   [--create-groups-secrets [groups_secrets_folder]]\n                   [--create-users-secrets [users_secrets_folder]]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  --list-groups         List LDAP groups\n  --create-policies     Create policies from LDAP groups and users\n  --manage-ldap-groups [LDAP_mount_point]\n                        Create LDAP groups in Vault with associated policies\n                        at specified mount point\n  --manage-ldap-users [LDAP_mount_point]\n                        Create LDAP users in Vault with associated policies\n                        and groups at specified mount point\n  --create-groups-secrets [groups_secrets_folder]\n                        Create a folder for each group in\n                        \u003cgroups_secrets_folder\u003e\n  --create-users-secrets [users_secrets_folder]\n                        Create a folder for each user in\n                        \u003cusers_secrets_folder\u003e\n```\n\n### Configuration file\n\nThree files are needed by this module\n\n* `$VAULT_CONFIG/ldap.yml`\n* `$VAULT_CONFIG/policies/policies.yml`\n* `$VAULT_CONFIG/policies/group_policy.hcl`\n* `$VAULT_CONFIG/policies/user_policy.hcl`\n\n**ldap.yml** is the configuration file of the **ldap** module\n\n```yaml\nldap:\n  server: ldap://\u003cURL\u003e\n  username: \u003cLDAP_username\u003e\n  password: \u003cLDAP_password_Vault_path\u003e\n  group_dn: OU=\u003cgroup1\u003e,OU=\u003cgroup2\u003e,DC=\u003ccompany\u003e\n  user_dn: OU=\u003cusers1\u003e,OU=\u003cusers2\u003e,DC=\u003ccompany\u003e\n```\n\n**policies.yml** is used by **ldap** module.\n\ne.g. **policies.yml**\n\n```yaml\ngeneral:\n  group:\n    # Policy used to generate groups policies\n    default_policy: group_policy.hcl\n    # The root policy will be applied to the following groups\n    # in addition of their own policy\n    root: [root_group_1, root_group_2]\n  user:\n    # Policy used to generate users policies\n    default_policy: user_policy.hcl\n    # The root policy will be applied to the following users\n    # in addition of their own policy\n    root: [root_user_1, root_user_2]\n\n# By default no groups are added\n# All have to be specified\ngroups:\n  groups_to_add:\n    - \u003cLDAP_group_name_1\u003e\n    - \u003cLDAP_group_name_2\u003e\n\n# By default all users are added\n# Each user to exclude have to be listed below\nusers:\n  users_to_exclude:\n    - \u003cuser_1\u003e\n    - \u003cuser_2\u003e\n```\n\n**group_policy.hcl** contains the default policy for groups. The pattern `{{GROUP_NAME}}` will be replaced by the group name.\n\ne.g. **group_policy.hcl**\n\n```hcl\n# Groups default policy\npath \"groups/\" {\n  capabilities = [\"list\"]\n}\n\npath \"groups/{{GROUP_NAME}}/*\"  {\n  capabilities = [\"read\", \"create\", \"update\", \"delete\", \"list\"]\n}\n```\n\n**user_policy.hcl** contains the default policy for users. The pattern `{{USER_NAME}}` will be replaced by the user name.\n\ne.g. **user_policy.hcl**\n\n```hcl\n# Default policy for user\npath \"users/\" {\n  capabilities = [\"list\"]\n}\n\npath \"users/{{USER_NAME}}/*\" {\n  capabilities = [\"read\", \"create\", \"update\", \"delete\", \"list\"]\n}\n```\n\n### arguments\n\n#### list-groups\n\n`vault-manager ldap --list-groups`\n\n**list-groups** will display found LDAP groups\n\n**WARNING:** The env var specified in `ldap.yml` under `ldap.password` must be set.\nIt should be the password the LDAP account specified in `ldap.yml` under `ldap.username`.   \n\n#### create-policies\n\n`vault-manager ldap --create-policies`\n\n**create-policies** will create all policies.\n\n* Groups policies for groups specified in the **policies.yml** under `groups_to_add`\n* Users policies for all users members of the groups specified in **policies.yml** under `groups_to_add` except users specified in `users_to_exclude`\n\nTwo subfolders will be created in `$VAULT_CONFIG/policies`\n\n* `users` under which will be created users policies\n* `groups` under which will be created groups policies\n\nEach user policy will be created with the following file name\n`\u003cuser_name\u003e.hcl`\n\nEach group policy will be created with the following file name\n`\u003cgroup_name\u003e.hcl`\n\n**NOTE:** If a policy file already exists, it will not be overwritten\n\n**WARNING:** If a group or user previously included in **policies.yml** is removed, all associated policies will be deleted\n\n#### manage-ldap-groups\n\n`vault-manager ldap --manage-ldap-groups [LDAP_mount_point]`\n\n**manage-ldap-groups** will create groups found in LDAP under the LDAP_mount_point Vault configuration. See Vault documentation for more details [create-update-ldap-group](https://www.vaultproject.io/api/auth/ldap/index.html#create-update-ldap-group)\nThe correct policy for the group will be applied\n\n#### manage-ldap-users\n\n`vault-manager ldap --manage-ldap-users [LDAP_mount_point]`\n\n**manage-ldap-users** will create users found in LDAP under the LDAP_mount_point Vault configuration. See Vault documentation for more details [create-update-ldap-user](https://www.vaultproject.io/api/auth/ldap/index.html#create-update-ldap-user)\nThe correct policy for the group will be applied\n\n#### create-groups-secrets\n\n`vault-manager ldap --create-groups-secrets [groups_secrets_folder]`\n\n**create-groups-secrets** will create/delete a secret 'folder' for each LDAP group at `groups_secrets_folder/{{GROUP_NAME}}`.\n\n**NOTE:** If the folder already exists, it will not be modified\n\n**WARNING:** If secrets 'folder' have to be deleted (because the group doesn't exists in configuration anymore), **all secrets in this 'folder' will be lost**\n\n#### create-users-secrets\n\n`vault-manager ldap --create-users-secrets [users_secrets_folder]`\n\n**create-users-secrets** will create/delete a secret 'folder' for each LDAP user at `users_secrets_folder/{{USER_NAME}}`.\n\n**NOTE:** If the folder already exists, it will not be modified\n\n**WARNING:** If secrets 'folder' have to be deleted (because the user doesn't exists in configuration anymore), **all secrets in this 'folder' will be lost**\n\n## policies\n\nThe **policies** module allows to manage policies in Vault\n\n```bash\n$\u003e vault-manager policies -h\nusage: vault-manager policies [-h] [--pull] [--push]\n\noptional arguments:\n  -h, --help  show this help message and exit\n  --pull      Pull distant policies from Vault\n  --push      Push local policies to Vault\n```\n\n### arguments\n\n#### pull\n\n`vault-manager policies --pull`\n\n**pull** will fetch all policies in Vault and create policy files in `$VAULT_CONFIG/policies`\n\n**IMPORTANT:** Every policy in Vault have to match the following naming convention\n`\u003ckeyword\u003e_\u003cpolicy_name\u003e_policy`.\ne.g. `user_\u003cpolicy_name\u003e_policy`, `service_\u003cpolicy_name\u003e_policy`\nIf a policy does not match this naming pattern, it will not be pulled\n\n**NOTE:** Policies already in Vault by default `default` and `root` will never be pulled\n\nA subfolder for each `keyword` found in policies will be created and associated policies files will be created under it.\ne.g. Following policies in Vault\n\n```bash\n$\u003e vault policy list\ndefault\nuser_bob_policy\ngroup_admins_policy\nservice_jenkins_policy\nservice_concourse_policy\nroot\n```\n\nwill create the following folders tree in the `$VAULT_CONFIG/policies` folder\n\n```tree\npolicies\n├── user\n│   └── bob.hcl\n├── group\n│    └── admins.hcl\n└── service\n    ├── jenkins.hcl\n    └── concourse.hcl\n```\n\n#### push\n\n`vault-manager policies --push`\n\n**push** will push all policies found in `$VAULT_CONFIG/policies` to Vault.\nPolicies naming works the same way than describe above\n\n**NOTE:** Policies already in Vault by default `default` and `root` will never be deleted/modified\n\nOnly policies in subfolders will be pushed to Vault\ne.g. Following folders tree\n\n```tree\npolicies\n├── user\n│   └── bob.hcl\n├── group\n│    └── admins.hcl\n└── service\n    ├── jenkins.hcl\n    └── concourse.hcl\n```\n\nwill create the following policies in vault\n\n```bash\n$\u003e vault policy list\ndefault\nuser_bob_policy\ngroup_admins_policy\nservice_jenkins_policy\nservice_concourse_policy\nroot\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleboncoin%2Fvault-manager","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fleboncoin%2Fvault-manager","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleboncoin%2Fvault-manager/lists"}