Roles and permissions

These are the built-in roles for the Vault service. Each row lists a role, what it grants, and the exact permissions it includes. Roles are system-defined (built-in) or custom; permissions are system-defined and read-only. The platform-wide Viewer, Editor, and Admin roles also apply across every service; see the roles and permissions catalogue. You can also compose a custom role from any of these permissions.

Role	Included permissions
Vault Viewer Read-only access to all vault resources	vault.accesspolicy.get vault.accesspolicy.list vault.applicationcredential.get vault.applicationcredential.list vault.certificate.get vault.certificate.list vault.certificateauthority.get vault.certificateauthority.list vault.cryptokey.get vault.cryptokey.list vault.cryptokeyversion.get vault.cryptokeyversion.list vault.databaserole.get vault.databaserole.list vault.lease.get vault.lease.list vault.operation.get vault.operation.list vault.pkirole.get vault.pkirole.list vault.secret.get vault.secret.list vault.secretversion.get vault.secretversion.list
Vault Editor Read and write access to all vault resources	vault.accesspolicy.create vault.accesspolicy.get vault.accesspolicy.list vault.accesspolicy.update vault.applicationcredential.create vault.applicationcredential.get vault.applicationcredential.list vault.applicationcredential.revoke vault.applicationcredential.rotatesecretid vault.applicationcredential.update vault.certificate.get vault.certificate.getcrl vault.certificate.issue vault.certificate.list vault.certificateauthority.create vault.certificateauthority.get vault.certificateauthority.list vault.cryptokey.create vault.cryptokey.decrypt vault.cryptokey.encrypt vault.cryptokey.generatedatakey vault.cryptokey.generaterandombytes vault.cryptokey.get vault.cryptokey.hmac vault.cryptokey.list vault.cryptokey.reencrypt vault.cryptokey.rotate vault.cryptokey.sign vault.cryptokey.update vault.cryptokey.verify vault.cryptokeyversion.disable vault.cryptokeyversion.get vault.cryptokeyversion.list vault.databaserole.create vault.databaserole.get vault.databaserole.list vault.databaserole.update vault.dynamiccredential.generatecloud vault.dynamiccredential.generatedatabase vault.dynamiccredential.generatekubernetestoken vault.dynamiccredential.issuesshotp vault.dynamiccredential.signsshcertificate vault.lease.get vault.lease.list vault.lease.renew vault.operation.get vault.operation.list vault.pkirole.create vault.pkirole.get vault.pkirole.list vault.pkirole.update vault.responsewrapping.unwrap vault.responsewrapping.wrap vault.secret.addversion vault.secret.create vault.secret.get vault.secret.list vault.secret.update vault.secretversion.disable vault.secretversion.get vault.secretversion.list vault.vault.snapshot
Vault Admin Full access to all vault resources	vault.accesspolicy.create vault.accesspolicy.delete vault.accesspolicy.get vault.accesspolicy.list vault.accesspolicy.update vault.applicationcredential.authenticate vault.applicationcredential.create vault.applicationcredential.delete vault.applicationcredential.get vault.applicationcredential.list vault.applicationcredential.revoke vault.applicationcredential.rotatesecretid vault.applicationcredential.update vault.certificate.get vault.certificate.getcrl vault.certificate.issue vault.certificate.list vault.certificate.revoke vault.certificateauthority.create vault.certificateauthority.delete vault.certificateauthority.get vault.certificateauthority.list vault.certificateauthority.revoke vault.cryptokey.create vault.cryptokey.decrypt vault.cryptokey.delete vault.cryptokey.encrypt vault.cryptokey.generatedatakey vault.cryptokey.generaterandombytes vault.cryptokey.get vault.cryptokey.hmac vault.cryptokey.list vault.cryptokey.reencrypt vault.cryptokey.rotate vault.cryptokey.sign vault.cryptokey.update vault.cryptokey.verify vault.cryptokeyversion.disable vault.cryptokeyversion.get vault.cryptokeyversion.list vault.cryptokeyversion.scheduledestroy vault.databaserole.create vault.databaserole.delete vault.databaserole.get vault.databaserole.list vault.databaserole.update vault.dynamiccredential.generatecloud vault.dynamiccredential.generatedatabase vault.dynamiccredential.generatekubernetestoken vault.dynamiccredential.issuesshotp vault.dynamiccredential.signsshcertificate vault.lease.bulkrevoke vault.lease.get vault.lease.list vault.lease.renew vault.lease.revoke vault.operation.get vault.operation.list vault.pkirole.create vault.pkirole.delete vault.pkirole.get vault.pkirole.list vault.pkirole.update vault.responsewrapping.unwrap vault.responsewrapping.wrap vault.secret.addversion vault.secret.create vault.secret.delete vault.secret.get vault.secret.list vault.secret.update vault.secretversion.destroy vault.secretversion.disable vault.secretversion.get vault.secretversion.list vault.vault.restore vault.vault.rotaterootkey vault.vault.snapshot
Secret Viewer View vault secrets	vault.secret.get vault.secret.list vault.secretversion.get vault.secretversion.list
Secret Editor View and manage vault secrets	vault.secret.addversion vault.secret.create vault.secret.get vault.secret.list vault.secret.update vault.secretversion.disable vault.secretversion.get vault.secretversion.list
Secret Admin Full access to vault secrets	vault.secret.addversion vault.secret.create vault.secret.delete vault.secret.get vault.secret.list vault.secret.update vault.secretversion.destroy vault.secretversion.disable vault.secretversion.get vault.secretversion.list
CryptoKey Viewer View crypto keys	vault.cryptokey.get vault.cryptokey.list vault.cryptokeyversion.get vault.cryptokeyversion.list
CryptoKey Editor View and manage crypto keys	vault.cryptokey.create vault.cryptokey.decrypt vault.cryptokey.encrypt vault.cryptokey.generatedatakey vault.cryptokey.generaterandombytes vault.cryptokey.get vault.cryptokey.hmac vault.cryptokey.list vault.cryptokey.reencrypt vault.cryptokey.rotate vault.cryptokey.sign vault.cryptokey.update vault.cryptokey.verify vault.cryptokeyversion.disable vault.cryptokeyversion.get vault.cryptokeyversion.list
CryptoKey Admin Full access to crypto keys	vault.cryptokey.create vault.cryptokey.decrypt vault.cryptokey.delete vault.cryptokey.encrypt vault.cryptokey.generatedatakey vault.cryptokey.generaterandombytes vault.cryptokey.get vault.cryptokey.hmac vault.cryptokey.list vault.cryptokey.reencrypt vault.cryptokey.rotate vault.cryptokey.sign vault.cryptokey.update vault.cryptokey.verify vault.cryptokeyversion.disable vault.cryptokeyversion.get vault.cryptokeyversion.list vault.cryptokeyversion.scheduledestroy
Lease Viewer View leases	vault.lease.get vault.lease.list
Lease Editor View and renew/revoke leases	vault.dynamiccredential.generatecloud vault.dynamiccredential.generatedatabase vault.dynamiccredential.generatekubernetestoken vault.dynamiccredential.issuesshotp vault.dynamiccredential.signsshcertificate vault.lease.get vault.lease.list vault.lease.renew vault.lease.revoke
Lease Admin Full access to leases including bulk revoke	vault.dynamiccredential.generatecloud vault.dynamiccredential.generatedatabase vault.dynamiccredential.generatekubernetestoken vault.dynamiccredential.issuesshotp vault.dynamiccredential.signsshcertificate vault.lease.bulkrevoke vault.lease.get vault.lease.list vault.lease.renew vault.lease.revoke
CertificateAuthority Viewer View certificate authorities	vault.certificateauthority.get vault.certificateauthority.list
CertificateAuthority Editor View and manage certificate authorities	vault.certificateauthority.create vault.certificateauthority.get vault.certificateauthority.list
CertificateAuthority Admin Full access to certificate authorities	vault.certificateauthority.create vault.certificateauthority.delete vault.certificateauthority.get vault.certificateauthority.list vault.certificateauthority.revoke
Certificate Viewer View certificates	vault.certificate.get vault.certificate.getcrl vault.certificate.list
Certificate Editor Issue and view certificates	vault.certificate.get vault.certificate.getcrl vault.certificate.issue vault.certificate.list
Certificate Admin Full access to certificates including revoke	vault.certificate.get vault.certificate.getcrl vault.certificate.issue vault.certificate.list vault.certificate.revoke
AccessPolicy Viewer View access policies	vault.accesspolicy.get vault.accesspolicy.list
AccessPolicy Editor View and manage access policies	vault.accesspolicy.create vault.accesspolicy.get vault.accesspolicy.list vault.accesspolicy.update
AccessPolicy Admin Full access to access policies	vault.accesspolicy.create vault.accesspolicy.delete vault.accesspolicy.get vault.accesspolicy.list vault.accesspolicy.update
VaultOperation Viewer View vault operation history	vault.operation.get vault.operation.list
VaultOperation Editor View vault operation history (no write actions)	vault.operation.get vault.operation.list
VaultOperation Admin Full access to vault operation history	vault.operation.get vault.operation.list

Related

• Vault overview
• The authorization model
• Roles and permissions catalogue