sys/policies/acl/cf 403 on binding vault to app

[rbprado]

Hello I'm getting this 403 error on binding the app to the vault service:

$ cf bind-service my-app sbil-vault
Binding service sbil-vault to app my-app in org SvcsIT-AnEOrg / space devops as Rafael_Prado...
Service broker error: failed to create policy cf-eabb9d6c-2f3c-43ef-a76d-4e0e25eda128: Error making API request.
URL: PUT http://svcsltslab1.com/v1/sys/policies/acl/cf-eabb9d6c-2f3c-43ef-a76d-4e0e25eda128

Code: 403. Errors:
* 1 error occurred:
* permission denied
FAILED

I handled it by adding this to the cf-broker.hcl:

path "sys/policies/acl/cf-*" {
  capabilities = ["create", "update", "delete"]
}

This is not on the README.md doc, I was going to generate a PR for it but as I'm very new to vault and I don't know if it's correct to add this policy I believe that I should first ask about it here :)

[tvoran]

Hi there, I think you're correct! And we should update the README. It looks like a while ago the vault client switched from using sys/policy to sys/policies/acl when creating and updating policies in Vault: hashicorp/vault#5583 So I think that's where the discrepancy came from.