vault policy endpoint `sys/policies/acl/:policy_name` doesnt accept a valid json nor hcl file

[noahehall]

Describe the bug A clear and concise description of what the bug is.

To Reproduce Steps to reproduce the behavior:

• highly likely i'm doing something wrong. but here it goes
  1. send this payload
  2. to /v1/sys/policies/acl/any_name_here
  3. See errors listed on this page from 4 years ago
  4. if it matters, i'm using this fn to make the request

{"errors":["'policy' parameter not supplied or empty"]}

{"errors":["1 error occurred:\n\n* error converting input map[path:map[auth/*:map[capabilities:[create read update delete list sudo]]]] for field \"policy\": '' expected type 'string', got unconvertible type 'map[string]interface {}'"]}

Expected behavior A clear and concise description of what you expected to happen.

• I am able to send a file in json or hcl format to policy create endpoint

Environment:

• Vault Server Version (retrieve with vault status):

Key                     Value
---                     -----
Seal Type               shamir
Initialized             true
Sealed                  false
Total Shares            1
Threshold               1
Version                 1.12.2
Build Date              2022-11-23T12:53:46Z
Storage Type            raft
Cluster Name            vault-cluster-0321cbaf
Cluster ID              8c914bb5-aa7c-8c91-93b4-d61c7bcfdd90
HA Enabled              true
HA Cluster              https://127.0.0.1:8301
HA Mode                 active
Active Since            2022-12-24T19:49:42.537814557Z
Raft Committed Index    98
Raft Applied Index      98

• Vault CLI Version (retrieve with vault version):
• Server Operating System/Architecture:

Vault server configuration file(s):

# Paste your Vault config here.

```sh
Vault v1.12.2 (415e1fe3118eebd5df6cb60d13defdc01aa17b03), built 2022-11-23T12:53:46Z

Be sure to scrub any sensitive values

Additional context Add any other context about the problem here.

• this gist by @v6 saved the day

[maxb]

You are not sending the correct body payload in the HTTP request. An example correct payload is featured in the documentation for the endpoint: https://developer.hashicorp.com/vault/api-docs/system/policies#create-update-acl-policy

[maxb]

• this gist by @v6 saved the day

That's not a good solution and will mangle some more complex policies into invalid input.

If you want to automate Vault from shell scripts, you should take a look at the Vault CLI, which provides helpful commands such as:

vault policy write <policy-name> <file-to-read-from>

as well as other commands which let you do most operations in a much more concise way. You'll still need jq in places, but simple things can be written simply.

Or if you really want to avoid that, and stick more closely to the style you are currently using, you should use the jq -n -c --arg approach you are already using in other places in your script, to build the policy request body, because that will be more reliable than the gist you found.

[noahehall]

thanks for the tips @maxb

its unfortunate the endpoint doesnt accept policies written in JSON, which would alleviate the issue of having to escape a bunch of double quotes

as for the script, its only for bootstrapping vault servers on init and testing integration before downstream services integrate.

the majority of services in my environment will not have access to a vault agent, vault cli or a human to configure, so having a 100% http api compatible vault integration is a requirement.

I'll likely follow your advice and write a policy parser, that handles escaping of the policy path - for now, i'll refrain from using any complex policies

[noahehall]

took another look at the payload that the policy endpoint accepts, and @maxb you are indeed, correct just need to escape all the quotes in the policy and send the entire thing as a string

creating policy policy_admin_vault:
path "secret/*" { # kv-v2
  capabilities = [ "create", "read", "update", "delete", "list", "patch", "sudo"]
}

path "env/*" { # kv-v1
  capabilities = [ "create", "read", "update", "delete", "list", "patch", "sudo"]
}

path "sys/*" {
  capabilities = [ "create", "read", "update", "delete", "list", "patch", "sudo" ]
}

path "auth/*" {
  capabilities = [ "create", "read", "update", "delete", "list", "patch", "sudo" ]
}

path "database/*" {
  capabilities = [ "create", "read", "update", "delete", "list", "patch", "sudo" ]
}

path "pki*" {
  capabilities = [ "create", "read", "update", "delete", "list", "patch", "sudo" ]
}

[DEBUG] SCRIPT.VAULT.SH
------------
[url]: https://dev.nirv.ai:8300/v1/sys/policies/acl/policy_admin_vault
[args]: -H X-Vault-Token: hvs.EqX-Bzh2cy5yb1lkcXlraHhYWmlLY1R5U2FxcTdoTWo --data {
    "policy": 
        "

                path \"secret/*\" {   
                        capabilities = [ \"create\", \"read\", \"update\", \"delete\", \"list\", \"patch\", \"sudo\"]
                }
                path \"env/*\" {  
                        capabilities = [ \"create\", \"read\", \"update\", \"delete\", \"list\", \"patch\", \"sudo\"]
                }
                path \"sys/*\" {  
                        capabilities = [ \"create\", \"read\", \"update\", \"delete\", \"list\", \"patch\", \"sudo\" ]
                }
                path \"auth/*\" {  
                        capabilities = [ \"create\", \"read\", \"update\", \"delete\", \"list\", \"patch\", \"sudo\" ]
                }
                path \"database/*\" {  
                        capabilities = [ \"create\", \"read\", \"update\", \"delete\", \"list\", \"patch\", \"sudo\" ]
                }
                path \"pki*\" {  
                        capabilities = [ \"create\", \"read\", \"update\", \"delete\", \"list\", \"patch\", \"sudo\" ]
                }
        "
    }