Hashicorp Vault — Create Auth Tokens Only, Don't read secrets

Question

I'm using Hashicorp Vault:

https://www.vaultproject.io/

I want a user that can create new users, but can't read their secrets.

Would I just create a policy like:

path "sys/auth/token/*" {
  policy = "write"
}

since all policies are set to deny?

Answer 1

This was the incorrect way to use Vault. These were my errors:

• Trying to store user passwords. For me, it looks better to handle platform passwords, like the integrated temporary postgre credentials.
• Trying to remove any trace of authentication keys on the server. If Vault users were going to be created automatically, Vault credentials will need to exist somewhere, either in a script or file with proper permissions.
• Trying to mitigate a rooted server. If someone has root access, there are larger problems than that. Encryption can mitigate data leaks, like a database dump. Data leaks if root access has been compromised in my case must be accepted. It's best to focus on not getting rooted.