How does authentication and authorization work in Vault?
⚡
Quick Answer
Clients authenticate via an auth method to get a token; policies attached to that token grant path-scoped capabilities.
Detailed Answer
Auth methods (Kubernetes, AWS IAM, AppRole, OIDC) verify identity and issue a token. Policies written in HCL grant capabilities (read/create/update/delete/list) on specific paths. This decouples identity from permissions and enforces least privilege per path.
Code Example
path "secret/data/app/*" {
capabilities = ["read"]
}💡
Interview Tip
Auth method = identity; policy = permissions.
vaultauthpolicies