Skip to main content
Vault policies define fine-grained authorization rules for accessing secrets and operations. Using Vault’s policy namespace in the CLI, you can list, read, create/update, delete, and format policy files. For detailed syntax, see the Vault CLI Policy Commands.

​
1. Listing Policies

To view all policies currently loaded into Vault:
Sample output:
Vault always provides a default and root policy. Custom policies appear alongside these.

​
2. Writing (Creating or Updating) a Policy

Create a new policy or update an existing one by specifying the policy name and the path to your HCL file:
Expected output:
Steps breakdown:
  1. vault – invokes the Vault CLI
  2. policy – selects the policy management namespace
  3. write – subcommand for creation or update
  4. admin-policy – policy name
  5. /tmp/admin.hcl – HCL file path
Ensure the HCL file path is correct and accessible. Relative or absolute paths both work.

​
3. Reading a Policy

To inspect the rules defined in a policy:
This outputs the HCL block that defines all allowed paths and capabilities for admin-policy.

​
4. Deleting a Policy

Remove a policy when it’s no longer needed:
Expected output:
Deleting a policy is irreversible. Make sure it’s no longer in use by any Vault tokens or roles.

​
5. Formatting a Policy File

If your HCL file has inconsistent whitespace or indentation, fmt will rewrite it in a canonical form:
This command overwrites /tmp/admin.hcl with a properly formatted version.

​
Example: Creating a webapp Policy

Given an HCL file /tmp/webapp.hcl, create a new policy named webapp:
You should see:
Now, running vault policy list will include webapp:

Watch Video