home-iac/terraform/vault-debmini/main.tf

resource "vault_token" "superuser" {
  policies = ["super-user"]
  display_name = "superuser"
  renewable = true
  ttl = "768h"
  metadata = {
   "purpose" = "service account for managing vault"
  }
  lifecycle {
   create_before_destroy = true
  }
}

resource "vault_policy" "super_user" {
  name = "super-user"
  policy = <<EOT
path "sys/policies/acl" {
    capabilities = ["list"]
}
path "sys/policies/acl/*" {
    capabilities = ["create", "read", "update", "delete", "list", "patch"]
}
path "auth/*" {
    capabilities = ["create", "read", "update", "delete", "list", "patch"]
}
path "sys/auth/*" {
    capabilities = ["create", "read", "update", "delete", "list", "patch"]
}
path "sys/auth" {
    capabilities = ["read"]
}
path "identity/*" {
    capabilities = ["create", "read", "update", "delete", "list"]
}
path "secret/*" {
    capabilities = ["create", "read", "update", "delete", "list", "patch"]
}
path "pki/*" {
    capabilities = ["create", "read", "update", "delete", "list", "patch"]
}
path "pki_root/*" {
    capabilities = ["create", "read", "update", "delete", "list", "patch"]
}
path "pki_intermediate/*" {
    capabilities = ["create", "read", "update", "delete", "list", "patch"]
}
path "sys/leases/*" {
    capabilities = ["read", "update", "list"]
}
path "sys/namespaces/*" {
    capabilities = ["create", "read", "update", "delete", "list", "patch"]
}
path "sys/mounts" {
    capabilities = ["read"]
}
path "sys/internal/ui/mounts" {
    capabilities = ["read"]
}
path "sys/license" {
    capabilities = ["create", "read", "update", "delete", "list"]
}
path "sys/config/ui" {
    capabilities = ["read", "update", "delete", "list"]
}
EOT
}