Exam HCVA0-003 Topic 2 Question 185 Discussion

Vault policies are path-based. This means authorization rules are written against Vault paths and the capabilities allowed on those paths. Policies do not need to be created separately for every individual secret because wildcard and path patterns can cover groups of secrets. Vault policies do not support full regular expressions, and permission types are not arbitrarily extended as plugins. The * wildcard is a glob wildcard and is limited in how it can be used; in standard ACL path rules, it is used only as a suffix glob at the end of a path pattern. Vault also supports path matching through its policy syntax, but not unrestricted wildcard placement everywhere in the path. Therefore, the two correct statements are that policies support suffix globbing with * and that policies are path-based.