KeyControl Vault for Secrets Access Policies

The KeyControl Vault for Secrets supports Role-based Access Control (RBAC) Policies. Access to secrets is denied by default, and must be explicitly granted through Access Control Policies.

Roles

Roles define actions or operations that can be performed on the KeyControl Vault for Secrets and secrets. The following pre-defined roles are supported: 

Vault Admin Role

Vault administrators have full access to all aspects of the KeyControl Vault for Secrets. This access includes: 

• Box management—Can create and manage boxes.

• Secret management—Can create and manage secrets within boxes, and checkout secrets.

• Policy management—Can create role-based access control policies to allow users or applications the ability to access secrets.

• View audit logs—Can view audit logs.

Vault User Role

The vault user role is assigned to users and applications who need access to the secrets. They have the following permissions: 

• List box IDs—Can retrieve the list of boxes (the box name and ID only) that the user or application has been granted access to.

• List secrets—Can retrieve the list of secrets that the user or application has been granted access to.

• Checkout secrets—Can retrieve the secret value.

• Checkin secrets—Can checkin the secret after use.

• List my checkouts—Can retrieve the outstanding secret leases for the user or application.

• Get secret metadata—Can retrieve secret metadata such as description and tags, for secrets that the user is granted access.

Vault Box Admin Role

Vault box administrators can perform various tasks on boxes they are allowed to administer, including:

• Box management—Update box properties and tag boxes.

• Secret management—Can create and manage secrets, and checkout secrets within boxes they can administer.
  Note that the Vault Box Admin cannot checkout secrets by default (they must be part of the relevant Vault User Policy)

• Leases—View and delete checkout leases pertaining to secrets in the box administered by box administrator.

• View audit logs—Can view and download audit logs.

A summary of the roles and permissions:

Action	Vault Admin	Box Admin	Vault User
Create Box	Yes	No	No
Update Box properties	Yes	Yes - on boxes they are allowed to administer	No
Tag/Untag Box	Yes	Yes - on boxes they are allowed to administer	No
Delete Box	Yes	No	No
Create Secret	Yes	Yes - on boxes they are allowed to administer	No
Update Secret properties	Yes	Yes - on boxes they are allowed to administer	No
Tag/Untag Secret	Yes	Yes - on boxes they are allowed to administer	No
Update Secret value	Yes	Yes - on boxes they are allowed to administer	No
Delete Secret	Yes	Yes - on boxes they are allowed to administer	No
Checkout Secret	Yes - should be part of a Vault User Policy providing access to the secret	Yes - should be part of a Vault User Policy providing access to the secret	Yes - should be part of a Vault User Policy providing access to the secret
Create Policy	Yes	No	No
Update Policy	Yes	No	No
View Audit	Yes	Yes - only those audits corresponding to Boxes & Secrets within the Boxes administered	No
Download Audit	Yes	Yes with restrictions same as above	No

Policies

Vault administrators can create and manage access control policies that manage access to the secrets. Policies consist of the following: 

• Security principle—The list of users governed by this policy. This can be an individual local user, an AD user or an AD group.
• Role—The permissions or a list of actions/operations that are granted to the user. Only the vault user role is supported. For information on granting the vault admin role, see Default Admin Policy.
• Resources—The list of boxes and secrets in the vault that the user or group can access.

The maximum number of policy change versions that can be kept is 25.

Note: If you modify a policy and a user is logged on to a session using the policy, the policy changes are not applied to the active session; the changes are applied the next time the user starts a session.

Default Admin Policy

When a new vault is created, the KeyControl Vault for Secrets creates a default admin policy that grants the vault administrator role to the local user, AD user, or AD group that is set as the first vault administrator. The default admin policy is the only policy you can use to grant the vault admin role to other users. To do so, the Vault Administrator can edit the 'security principle' part of the default admin policy to grant the vault administrator role to additional users.

Vault User Policy

The Vault User Policy provides checkout/access permissions to secrets. A Vault User Policy MUST be created and assigned to a box or secret before a non-admin user can access the value for a secret. Vault Admins and Box Admins are not able to directly view a secret or any previous versions of secrets without being part of the Vault User Policy.

Box Admin Policy

The Box Admin Policy allows management and administration of boxes. Note that the Box Admin must be part of a relevant Vault User Policy to be able to checkout and view secrets, even on boxes that they can administer.

Vault Secondary Approver Policy

The Vault Secondary Approver Policy allows users to enable or disable secondary approval, and to grant or deny approval for secondary approval requests.