No permissions for sts role credentials when using Approle authentication

[bsachin12]

Hello,

My pipeline could not generate sts credentials when using Approle to authenticate via jenkins.

Here is the policy defined in vault

Jenkins policy

Login with AppRole

path "auth/approle/login" {
capabilities = [ "create", "read" ]
}

path "secret/aws/*" {
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

Jenkins Code

def secretz = [
[$class: 'VaultSecret',
path: "aws/sts/VaultTFE-Sandbox",
secretValues: [
[
$class: 'VaultSecretValue', envVar: 'AWS_SESSION_TOKEN', vaultKey: 'security_token'
],
[
$class: 'VaultSecretValue', envVar: 'AWS_ACCESS_KEY_ID', vaultKey: 'access_key'
],
[
$class: 'VaultSecretValue', envVar: 'AWS_SECRET_ACCESS_KEY', vaultKey: 'secret_key']]]
]

def conf = [
$class: 'VaultConfiguration',
vaultUrl: 'http://17.10.101.10:8200',
vaultCredentialId: 'VAULT_APP_ROLE'
]

wrap([$class: 'VaultBuildWrapper', configuration:conf, vaultSecrets: secretz]) {
withCredentials([string(credentialsId: 'VAULTAWSTOKEN', variable: 'VAULT_TOKEN')]) {
sh "${env.TERRAFORM_HOME} plan ${env.TERRAFORM_INPUT_VARS}"
}

Error thrown

com.bettercloud.vault.VaultException: Vault responded with HTTP status code: 403
Response body: {"errors":["1 error occurred:\n\t* permission denied\n\n"]}

at com.bettercloud.vault.api.Logical.read(Logical.java:70)
at com.bettercloud.vault.api.Logical.read(Logical.java:50)
at com.datapipe.jenkins.vault.VaultAccessor.read(VaultAccessor.java:34)

Caused: com.datapipe.jenkins.vault.exception.VaultPluginException: could not read from vault: Vault responded with HTTP status code: 403
Response body: {"errors":["1 error occurred:\n\t* permission denied\n\n"]}
at path: aws/sts/VaultTFE-Sandbox

[bsachin12]

Can I get some help in configuring policy.