Roles and permissions

These are the built-in roles for the Vault service. Each row lists a role, what it grants, and the exact permissions it includes. Roles are system-defined (built-in) or custom; permissions are system-defined and read-only. The platform-wide Viewer, Editor, and Admin roles also apply across every service; see the roles and permissions catalogue. You can also compose a custom role from any of these permissions.

A permission authorizes an operation whatever engine it runs on. The engines/{engine} selector decides where the work happens, not whether you may ask for it; see engine selection.

Role	Included permissions
Vault Viewer Read-only access to all vault resources	vault.capsule.get vault.capsule.list vault.certificate.get vault.certificate.list vault.certificateauthority.get vault.certificateauthority.list vault.certificatetemplate.get vault.certificatetemplate.list vault.cryptokey.get vault.cryptokey.list vault.cryptokeyversion.get vault.cryptokeyversion.list vault.operation.get vault.operation.list vault.secret.get vault.secret.list vault.secretversion.get vault.secretversion.list
Vault Editor Read and write access to all vault resources	vault.capsule.create vault.capsule.get vault.capsule.list vault.certificate.get vault.certificate.getcrl vault.certificate.issue vault.certificate.list vault.certificateauthority.create vault.certificateauthority.get vault.certificateauthority.list vault.certificatetemplate.create vault.certificatetemplate.get vault.certificatetemplate.list vault.certificatetemplate.update vault.cryptokey.create vault.cryptokey.decrypt vault.cryptokey.encrypt vault.cryptokey.generatedatakey vault.cryptokey.generaterandombytes vault.cryptokey.get vault.cryptokey.hmac vault.cryptokey.list vault.cryptokey.reencrypt vault.cryptokey.rotate vault.cryptokey.sign vault.cryptokey.update vault.cryptokey.verify vault.cryptokeyversion.disable vault.cryptokeyversion.get vault.cryptokeyversion.list vault.operation.get vault.operation.list vault.secret.addversion vault.secret.create vault.secret.get vault.secret.list vault.secret.update vault.secretversion.disable vault.secretversion.get vault.secretversion.list
Vault Admin Full access to all vault resources	vault.capsule.create vault.capsule.get vault.capsule.list vault.capsule.revoke vault.certificate.get vault.certificate.getcrl vault.certificate.issue vault.certificate.list vault.certificate.revoke vault.certificateauthority.create vault.certificateauthority.delete vault.certificateauthority.get vault.certificateauthority.list vault.certificateauthority.revoke vault.certificatetemplate.create vault.certificatetemplate.delete vault.certificatetemplate.get vault.certificatetemplate.list vault.certificatetemplate.update vault.cryptokey.create vault.cryptokey.decrypt vault.cryptokey.delete vault.cryptokey.encrypt vault.cryptokey.generatedatakey vault.cryptokey.generaterandombytes vault.cryptokey.get vault.cryptokey.hmac vault.cryptokey.list vault.cryptokey.reencrypt vault.cryptokey.rotate vault.cryptokey.sign vault.cryptokey.update vault.cryptokey.verify vault.cryptokeyversion.canceldestroy vault.cryptokeyversion.disable vault.cryptokeyversion.get vault.cryptokeyversion.list vault.cryptokeyversion.scheduledestroy vault.operation.get vault.operation.list vault.secret.addversion vault.secret.create vault.secret.delete vault.secret.get vault.secret.list vault.secret.update vault.secretversion.destroy vault.secretversion.disable vault.secretversion.get vault.secretversion.list
Secret Viewer View vault secrets	vault.secret.get vault.secret.list vault.secretversion.get vault.secretversion.list
Secret Editor View and manage vault secrets	vault.secret.addversion vault.secret.create vault.secret.get vault.secret.list vault.secret.update vault.secretversion.disable vault.secretversion.get vault.secretversion.list
Secret Admin Full access to vault secrets	vault.secret.addversion vault.secret.create vault.secret.delete vault.secret.get vault.secret.list vault.secret.update vault.secretversion.destroy vault.secretversion.disable vault.secretversion.get vault.secretversion.list
CryptoKey Viewer View crypto keys	vault.cryptokey.get vault.cryptokey.list vault.cryptokeyversion.get vault.cryptokeyversion.list
CryptoKey Editor View and manage crypto keys	vault.cryptokey.create vault.cryptokey.decrypt vault.cryptokey.encrypt vault.cryptokey.generatedatakey vault.cryptokey.generaterandombytes vault.cryptokey.get vault.cryptokey.hmac vault.cryptokey.list vault.cryptokey.reencrypt vault.cryptokey.rotate vault.cryptokey.sign vault.cryptokey.update vault.cryptokey.verify vault.cryptokeyversion.disable vault.cryptokeyversion.get vault.cryptokeyversion.list
CryptoKey Admin Full access to crypto keys	vault.cryptokey.create vault.cryptokey.decrypt vault.cryptokey.delete vault.cryptokey.encrypt vault.cryptokey.generatedatakey vault.cryptokey.generaterandombytes vault.cryptokey.get vault.cryptokey.hmac vault.cryptokey.list vault.cryptokey.reencrypt vault.cryptokey.rotate vault.cryptokey.sign vault.cryptokey.update vault.cryptokey.verify vault.cryptokeyversion.canceldestroy vault.cryptokeyversion.disable vault.cryptokeyversion.get vault.cryptokeyversion.list vault.cryptokeyversion.scheduledestroy
CertificateAuthority Viewer View certificate authorities	vault.certificateauthority.get vault.certificateauthority.list
CertificateAuthority Editor View and manage certificate authorities	vault.certificateauthority.create vault.certificateauthority.get vault.certificateauthority.list
CertificateAuthority Admin Full access to certificate authorities	vault.certificateauthority.create vault.certificateauthority.delete vault.certificateauthority.get vault.certificateauthority.list vault.certificateauthority.revoke
Certificate Viewer View certificates	vault.certificate.get vault.certificate.getcrl vault.certificate.list
Certificate Editor Issue and view certificates	vault.certificate.get vault.certificate.getcrl vault.certificate.issue vault.certificate.list
Certificate Admin Full access to certificates including revoke	vault.certificate.get vault.certificate.getcrl vault.certificate.issue vault.certificate.list vault.certificate.revoke
VaultOperation Viewer View vault operation history	vault.operation.get vault.operation.list
VaultOperation Editor View vault operation history (no write actions)	vault.operation.get vault.operation.list
VaultOperation Admin Full access to vault operation history	vault.operation.get vault.operation.list

Permissions no built-in role carries

Two sets sit outside the table above, and neither is grantable through it.

vault.safe.snapshot takes a snapshot of the whole vault backend, so it belongs to the installation rather than to a workspace. Only the platform Admin role holds it; the Vault Admin role above is every vault permission except this one.

Restore, root-key rotation, and the platform secret store (vault.platform.safe.restore, vault.platform.safe.rotaterootkey, vault.platform.secret.read / .write / .delete) live on a separate platform-authorization plane reserved for service-account principals. They cannot be added to any role, including a custom one, and cannot be held by a person.

Related

• Vault overview
• Engine selection
• The authorization model
• Roles and permissions catalogue