ScottyLabs/governance
Watch
25
2
Fork
You've already forked governance
 197
Code Issues 15 Pull requests 3 Projects Releases Packages Wiki Activity Actions 22

fix: grant leads list perms #486

Merged
brightz merged 4 commits from feat-openbao-lead-list into main 2026-10-04 15:27:59 +00:00
Conversation 7 Commits 4 Files changed 2 +74 -66
thesuperRL commented 2026-10-03 21:53:42 +00:00
Member
Copy link
No description provided.
fix: grant leads list perms
Some checks failed
CI / build (pull_request) Has been skipped
Details
atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.
Details
kennel/build skipped: no services or static sites defined
Details
Validate / Governance (pull_request_target) Has been cancelled
Details
CI / check (pull_request) Has been cancelled
Details
CI / check-1 (pull_request) Has been cancelled
Details
c3fa51f71b
anish requested changes 2026-10-03 21:54:03 +00:00
crates/governance-tfgen/src/generators/openbao.rs Outdated
@ -20,6 +20,16 @@ fn secretspec_policy(project: &str, profiles: &[&str]) -> String {
.join("\n\n")
}
/// The per-profile rules above only cover paths *inside* a profile, so a lead can list the keys of
anish commented 2026-10-03 21:54:01 +00:00
Member
Copy link

slop comment

slop comment
thesuperRL marked this conversation as resolved
anish requested changes 2026-10-03 21:55:28 +00:00
crates/governance-tfgen/src/generators/openbao.rs Outdated
@ -60,1 +70,3 @@
"policy": secretspec_policy(slug, &["prod", "staging", "ci"]),
"policy": format!(
"{}\n\n{}",
browse_policy(slug),
anish commented 2026-10-03 21:55:24 +00:00
Member
Copy link

also just add an item to the list in the secretspec policy, this shouldn't be a new function

also just add an item to the list in the secretspec policy, this shouldn't be a new function
thesuperRL marked this conversation as resolved
fix: issues
Some checks failed
CI / build (pull_request) Has been skipped
Details
atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.
Details
kennel/build skipped: no services or static sites defined
Details
Validate / Governance (pull_request_target) Has been cancelled
Details
CI / check (pull_request) Has been cancelled
Details
CI / check-1 (pull_request) Has been cancelled
Details
68ecca1a95
fix: remove comment
Some checks failed
CI / build (pull_request) Has been skipped
Details
atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.
Details
kennel/build skipped: no services or static sites defined
Details
Validate / Governance (pull_request_target) Successful in 3m3s
Details
CI / check-1 (pull_request) Failing after 4m56s
Details
CI / check (pull_request) Failing after 0s
Details
3c141056c2
chore: regenerate tofu, schemas, CODEOWNERS [skip ci]
Some checks failed
atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.
Details
atlantis/plan: git Plan failed.
Details
atlantis/plan: discord Plan failed.
Details
atlantis/plan: google_groups Plan failed.
Details
atlantis/plan: slack Plan failed.
Details
atlantis/plan: keycloak Plan failed.
Details
atlantis/plan: google_play Plan failed.
Details
atlantis/plan: openbao Plan: 0 to add, 52 to change, 0 to destroy.
Details
atlantis/plan 6/7 projects failed to plan.
kennel/build skipped: no services or static sites defined
Details
2dc3b198ae
scottylabs-bot commented 2026-10-03 23:57:53 +00:00
Owner
Copy link

Ran Plan for 7 projects:

  1. project: git dir: tofu/git workspace: default
  2. project: discord dir: tofu/discord workspace: default
  3. project: google_groups dir: tofu/google_groups workspace: default
  4. project: slack dir: tofu/slack workspace: default
  5. project: keycloak dir: tofu/keycloak workspace: default
  6. project: google_play dir: tofu/google_play workspace: default
  7. project: openbao dir: tofu/openbao workspace: default

1. project: git dir: tofu/git workspace: default

Plan Failed: This project is currently locked by an unapplied plan from pull #484. To continue, delete the lock from #484 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

2. project: discord dir: tofu/discord workspace: default

Plan Failed: This project is currently locked by an unapplied plan from pull #484. To continue, delete the lock from #484 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

3. project: google_groups dir: tofu/google_groups workspace: default

Plan Failed: This project is currently locked by an unapplied plan from pull #484. To continue, delete the lock from #484 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

4. project: slack dir: tofu/slack workspace: default

Plan Failed: This project is currently locked by an unapplied plan from pull #484. To continue, delete the lock from #484 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

5. project: keycloak dir: tofu/keycloak workspace: default

Plan Failed: This project is currently locked by an unapplied plan from pull #484. To continue, delete the lock from #484 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

6. project: google_play dir: tofu/google_play workspace: default

Plan Failed: This project is currently locked by an unapplied plan from pull #442. To continue, delete the lock from #442 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

7. project: openbao dir: tofu/openbao workspace: default

Show Output 
Compiling governance-schema v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-schema)
   Compiling governance-core v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-core)
   Compiling governance-tfgen v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-tfgen)
   Compiling governance v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-cli)
    Finished `release` profile [optimized] target(s) in 8.17s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
! update in-place (current -> planned)

OpenTofu will perform the following actions:

  # vault_policy.bus-sign_dev will be updated in-place
! resource "vault_policy" "bus-sign_dev" {
        id     = "bus-sign-dev"
        name   = "bus-sign-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/bus-sign" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/bus-sign/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.bus-sign_prod will be updated in-place
! resource "vault_policy" "bus-sign_prod" {
        id     = "bus-sign-prod"
        name   = "bus-sign-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/bus-sign" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/bus-sign/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_dev will be updated in-place
! resource "vault_policy" "cal_dev" {
        id     = "cal-dev"
        name   = "cal-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cal" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cal/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_prod will be updated in-place
! resource "vault_policy" "cal_prod" {
        id     = "cal-prod"
        name   = "cal-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cal" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cal/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_dev will be updated in-place
! resource "vault_policy" "changelog_dev" {
        id     = "changelog-dev"
        name   = "changelog-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/changelog" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/changelog/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_prod will be updated in-place
! resource "vault_policy" "changelog_prod" {
        id     = "changelog-prod"
        name   = "changelog-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/changelog" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/changelog/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_dev will be updated in-place
! resource "vault_policy" "cmugpt-agent_dev" {
        id     = "cmugpt-agent-dev"
        name   = "cmugpt-agent-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-agent" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-agent/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_prod will be updated in-place
! resource "vault_policy" "cmugpt-agent_prod" {
        id     = "cmugpt-agent-prod"
        name   = "cmugpt-agent-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-agent" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-agent/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_dev will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_dev" {
        id     = "cmugpt-mcp-server-dev"
        name   = "cmugpt-mcp-server-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-mcp-server" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-mcp-server/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_prod will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_prod" {
        id     = "cmugpt-mcp-server-prod"
        name   = "cmugpt-mcp-server-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-mcp-server" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-mcp-server/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_dev" {
        id     = "cmugpt-sms-surface-dev"
        name   = "cmugpt-sms-surface-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-sms-surface" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-sms-surface/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_prod" {
        id     = "cmugpt-sms-surface-prod"
        name   = "cmugpt-sms-surface-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-sms-surface" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-sms-surface/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-surface_dev" {
        id     = "cmugpt-surface-dev"
        name   = "cmugpt-surface-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-surface" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-surface/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-surface_prod" {
        id     = "cmugpt-surface-prod"
        name   = "cmugpt-surface-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-surface" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-surface/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_dev will be updated in-place
! resource "vault_policy" "components_dev" {
        id     = "components-dev"
        name   = "components-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/components" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/components/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_prod will be updated in-place
! resource "vault_policy" "components_prod" {
        id     = "components-prod"
        name   = "components-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/components" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/components/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_dev will be updated in-place
! resource "vault_policy" "courses_dev" {
        id     = "courses-dev"
        name   = "courses-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/courses" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/courses/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_prod will be updated in-place
! resource "vault_policy" "courses_prod" {
        id     = "courses-prod"
        name   = "courses-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/courses" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/courses/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_dev will be updated in-place
! resource "vault_policy" "dalmatian_dev" {
        id     = "dalmatian-dev"
        name   = "dalmatian-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/dalmatian" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/dalmatian/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_prod will be updated in-place
! resource "vault_policy" "dalmatian_prod" {
        id     = "dalmatian-prod"
        name   = "dalmatian-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/dalmatian" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/dalmatian/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_dev will be updated in-place
! resource "vault_policy" "discord-verify_dev" {
        id     = "discord-verify-dev"
        name   = "discord-verify-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/discord-verify" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/discord-verify/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_prod will be updated in-place
! resource "vault_policy" "discord-verify_prod" {
        id     = "discord-verify-prod"
        name   = "discord-verify-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/discord-verify" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/discord-verify/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_dev will be updated in-place
! resource "vault_policy" "documentation_dev" {
        id     = "documentation-dev"
        name   = "documentation-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/documentation" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/documentation/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_prod will be updated in-place
! resource "vault_policy" "documentation_prod" {
        id     = "documentation-prod"
        name   = "documentation-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/documentation" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/documentation/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_dev will be updated in-place
! resource "vault_policy" "eats_dev" {
        id     = "eats-dev"
        name   = "eats-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/eats" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/eats/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_prod will be updated in-place
! resource "vault_policy" "eats_prod" {
        id     = "eats-prod"
        name   = "eats-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/eats" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/eats/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_dev will be updated in-place
! resource "vault_policy" "groupme-mirror_dev" {
        id     = "groupme-mirror-dev"
        name   = "groupme-mirror-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/groupme-mirror" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/groupme-mirror/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_prod will be updated in-place
! resource "vault_policy" "groupme-mirror_prod" {
        id     = "groupme-mirror-prod"
        name   = "groupme-mirror-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/groupme-mirror" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/groupme-mirror/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_dev will be updated in-place
! resource "vault_policy" "housing_dev" {
        id     = "housing-dev"
        name   = "housing-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/housing" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/housing/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_prod will be updated in-place
! resource "vault_policy" "housing_prod" {
        id     = "housing-prod"
        name   = "housing-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/housing" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/housing/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_dev will be updated in-place
! resource "vault_policy" "insta_dev" {
        id     = "insta-dev"
        name   = "insta-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/insta" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/insta/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_prod will be updated in-place
! resource "vault_policy" "insta_prod" {
        id     = "insta-prod"
        name   = "insta-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/insta" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/insta/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_dev will be updated in-place
! resource "vault_policy" "link-shortener_dev" {
        id     = "link-shortener-dev"
        name   = "link-shortener-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/link-shortener" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/link-shortener/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_prod will be updated in-place
! resource "vault_policy" "link-shortener_prod" {
        id     = "link-shortener-prod"
        name   = "link-shortener-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/link-shortener" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/link-shortener/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_dev will be updated in-place
! resource "vault_policy" "lost-and-found_dev" {
        id     = "lost-and-found-dev"
        name   = "lost-and-found-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/lost-and-found" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/lost-and-found/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_prod will be updated in-place
! resource "vault_policy" "lost-and-found_prod" {
        id     = "lost-and-found-prod"
        name   = "lost-and-found-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/lost-and-found" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/lost-and-found/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_dev will be updated in-place
! resource "vault_policy" "maps_dev" {
        id     = "maps-dev"
        name   = "maps-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/maps" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/maps/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_prod will be updated in-place
! resource "vault_policy" "maps_prod" {
        id     = "maps-prod"
        name   = "maps-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/maps" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/maps/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_dev will be updated in-place
! resource "vault_policy" "occ-main_dev" {
        id     = "occ-main-dev"
        name   = "occ-main-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/occ-main" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/occ-main/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_prod will be updated in-place
! resource "vault_policy" "occ-main_prod" {
        id     = "occ-main-prod"
        name   = "occ-main-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/occ-main" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/occ-main/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_dev will be updated in-place
! resource "vault_policy" "quest_dev" {
        id     = "quest-dev"
        name   = "quest-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/quest" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/quest/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_prod will be updated in-place
! resource "vault_policy" "quest_prod" {
        id     = "quest-prod"
        name   = "quest-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/quest" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/quest/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_dev will be updated in-place
! resource "vault_policy" "scottylabs-org_dev" {
        id     = "scottylabs-org-dev"
        name   = "scottylabs-org-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/scottylabs-org" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/scottylabs-org/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_prod will be updated in-place
! resource "vault_policy" "scottylabs-org_prod" {
        id     = "scottylabs-org-prod"
        name   = "scottylabs-org-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/scottylabs-org" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/scottylabs-org/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-rfcs_dev will be updated in-place
! resource "vault_policy" "slai-rfcs_dev" {
        id     = "slai-rfcs-dev"
        name   = "slai-rfcs-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/slai-rfcs" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/slai-rfcs/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-rfcs_prod will be updated in-place
! resource "vault_policy" "slai-rfcs_prod" {
        id     = "slai-rfcs-prod"
        name   = "slai-rfcs-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/slai-rfcs" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/slai-rfcs/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_dev will be updated in-place
! resource "vault_policy" "study_dev" {
        id     = "study-dev"
        name   = "study-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/study" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/study/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_prod will be updated in-place
! resource "vault_policy" "study_prod" {
        id     = "study-prod"
        name   = "study-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/study" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/study/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_dev will be updated in-place
! resource "vault_policy" "tartan-vote_dev" {
        id     = "tartan-vote-dev"
        name   = "tartan-vote-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/tartan-vote" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/tartan-vote/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_prod will be updated in-place
! resource "vault_policy" "tartan-vote_prod" {
        id     = "tartan-vote-prod"
        name   = "tartan-vote-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/tartan-vote" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/tartan-vote/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_dev will be updated in-place
! resource "vault_policy" "terrier_dev" {
        id     = "terrier-dev"
        name   = "terrier-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/terrier" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/terrier/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_prod will be updated in-place
! resource "vault_policy" "terrier_prod" {
        id     = "terrier-prod"
        name   = "terrier-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/terrier" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/terrier/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 0 to add, 52 to change, 0 to destroy.
  • ▶️ To apply this plan, comment: 
    atlantis apply -p openbao
  • 🚮 To delete this plan and lock, click here
  • 🔁 To plan this project again, comment: 
    atlantis plan -p openbao

Plan: 0 to add, 52 to change, 0 to destroy.

Plan Summary

7 projects, 1 with changes, 0 with no changes, 6 failed

  • ⏩ To apply all unapplied plans from this Pull Request, comment: 
    atlantis apply
  • 🚮 To delete all plans and locks from this Pull Request, comment: 
    atlantis unlock
Ran Plan for 7 projects: 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `discord` dir: `tofu/discord` workspace: `default` 1. project: `google_groups` dir: `tofu/google_groups` workspace: `default` 1. project: `slack` dir: `tofu/slack` workspace: `default` 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `google_play` dir: `tofu/google_play` workspace: `default` 1. project: `openbao` dir: `tofu/openbao` workspace: `default` --- ### 1. project: `git` dir: `tofu/git` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #484. To continue, delete the lock from #484 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `discord` dir: `tofu/discord` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #484. To continue, delete the lock from #484 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `google_groups` dir: `tofu/google_groups` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #484. To continue, delete the lock from #484 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 4. project: `slack` dir: `tofu/slack` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #484. To continue, delete the lock from #484 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 5. project: `keycloak` dir: `tofu/keycloak` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #484. To continue, delete the lock from #484 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 6. project: `google_play` dir: `tofu/google_play` workspace: `default` **Plan Failed**: This project is currently locked by an unapplied plan from pull #442. To continue, delete the lock from #442 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 7. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Compiling governance-schema v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-schema) Compiling governance-core v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-core) Compiling governance-tfgen v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-tfgen) Compiling governance v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-cli) Finished `release` profile [optimized] target(s) in 8.17s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ! update in-place (current -> planned) OpenTofu will perform the following actions: # vault_policy.bus-sign_dev will be updated in-place ! resource "vault_policy" "bus-sign_dev" { id = "bus-sign-dev" name = "bus-sign-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/bus-sign" { + capabilities = ["list"] + } + path "secret/data/secretspec/bus-sign/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.bus-sign_prod will be updated in-place ! resource "vault_policy" "bus-sign_prod" { id = "bus-sign-prod" name = "bus-sign-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/bus-sign" { + capabilities = ["list"] + } + path "secret/data/secretspec/bus-sign/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_dev will be updated in-place ! resource "vault_policy" "cal_dev" { id = "cal-dev" name = "cal-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cal" { + capabilities = ["list"] + } + path "secret/data/secretspec/cal/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_prod will be updated in-place ! resource "vault_policy" "cal_prod" { id = "cal-prod" name = "cal-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cal" { + capabilities = ["list"] + } + path "secret/data/secretspec/cal/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_dev will be updated in-place ! resource "vault_policy" "changelog_dev" { id = "changelog-dev" name = "changelog-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/changelog" { + capabilities = ["list"] + } + path "secret/data/secretspec/changelog/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_prod will be updated in-place ! resource "vault_policy" "changelog_prod" { id = "changelog-prod" name = "changelog-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/changelog" { + capabilities = ["list"] + } + path "secret/data/secretspec/changelog/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_dev will be updated in-place ! resource "vault_policy" "cmugpt-agent_dev" { id = "cmugpt-agent-dev" name = "cmugpt-agent-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-agent" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-agent/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_prod will be updated in-place ! resource "vault_policy" "cmugpt-agent_prod" { id = "cmugpt-agent-prod" name = "cmugpt-agent-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-agent" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-agent/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_dev will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_dev" { id = "cmugpt-mcp-server-dev" name = "cmugpt-mcp-server-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-mcp-server" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-mcp-server/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_prod will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_prod" { id = "cmugpt-mcp-server-prod" name = "cmugpt-mcp-server-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-mcp-server" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-mcp-server/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_dev" { id = "cmugpt-sms-surface-dev" name = "cmugpt-sms-surface-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-sms-surface" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-sms-surface/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_prod" { id = "cmugpt-sms-surface-prod" name = "cmugpt-sms-surface-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-sms-surface" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-sms-surface/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-surface_dev" { id = "cmugpt-surface-dev" name = "cmugpt-surface-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-surface" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-surface/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-surface_prod" { id = "cmugpt-surface-prod" name = "cmugpt-surface-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-surface" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-surface/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_dev will be updated in-place ! resource "vault_policy" "components_dev" { id = "components-dev" name = "components-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/components" { + capabilities = ["list"] + } + path "secret/data/secretspec/components/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_prod will be updated in-place ! resource "vault_policy" "components_prod" { id = "components-prod" name = "components-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/components" { + capabilities = ["list"] + } + path "secret/data/secretspec/components/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_dev will be updated in-place ! resource "vault_policy" "courses_dev" { id = "courses-dev" name = "courses-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/courses" { + capabilities = ["list"] + } + path "secret/data/secretspec/courses/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_prod will be updated in-place ! resource "vault_policy" "courses_prod" { id = "courses-prod" name = "courses-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/courses" { + capabilities = ["list"] + } + path "secret/data/secretspec/courses/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_dev will be updated in-place ! resource "vault_policy" "dalmatian_dev" { id = "dalmatian-dev" name = "dalmatian-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/dalmatian" { + capabilities = ["list"] + } + path "secret/data/secretspec/dalmatian/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_prod will be updated in-place ! resource "vault_policy" "dalmatian_prod" { id = "dalmatian-prod" name = "dalmatian-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/dalmatian" { + capabilities = ["list"] + } + path "secret/data/secretspec/dalmatian/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_dev will be updated in-place ! resource "vault_policy" "discord-verify_dev" { id = "discord-verify-dev" name = "discord-verify-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/discord-verify" { + capabilities = ["list"] + } + path "secret/data/secretspec/discord-verify/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_prod will be updated in-place ! resource "vault_policy" "discord-verify_prod" { id = "discord-verify-prod" name = "discord-verify-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/discord-verify" { + capabilities = ["list"] + } + path "secret/data/secretspec/discord-verify/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_dev will be updated in-place ! resource "vault_policy" "documentation_dev" { id = "documentation-dev" name = "documentation-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/documentation" { + capabilities = ["list"] + } + path "secret/data/secretspec/documentation/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_prod will be updated in-place ! resource "vault_policy" "documentation_prod" { id = "documentation-prod" name = "documentation-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/documentation" { + capabilities = ["list"] + } + path "secret/data/secretspec/documentation/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_dev will be updated in-place ! resource "vault_policy" "eats_dev" { id = "eats-dev" name = "eats-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/eats" { + capabilities = ["list"] + } + path "secret/data/secretspec/eats/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_prod will be updated in-place ! resource "vault_policy" "eats_prod" { id = "eats-prod" name = "eats-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/eats" { + capabilities = ["list"] + } + path "secret/data/secretspec/eats/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_dev will be updated in-place ! resource "vault_policy" "groupme-mirror_dev" { id = "groupme-mirror-dev" name = "groupme-mirror-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/groupme-mirror" { + capabilities = ["list"] + } + path "secret/data/secretspec/groupme-mirror/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_prod will be updated in-place ! resource "vault_policy" "groupme-mirror_prod" { id = "groupme-mirror-prod" name = "groupme-mirror-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/groupme-mirror" { + capabilities = ["list"] + } + path "secret/data/secretspec/groupme-mirror/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_dev will be updated in-place ! resource "vault_policy" "housing_dev" { id = "housing-dev" name = "housing-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/housing" { + capabilities = ["list"] + } + path "secret/data/secretspec/housing/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_prod will be updated in-place ! resource "vault_policy" "housing_prod" { id = "housing-prod" name = "housing-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/housing" { + capabilities = ["list"] + } + path "secret/data/secretspec/housing/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_dev will be updated in-place ! resource "vault_policy" "insta_dev" { id = "insta-dev" name = "insta-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/insta" { + capabilities = ["list"] + } + path "secret/data/secretspec/insta/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_prod will be updated in-place ! resource "vault_policy" "insta_prod" { id = "insta-prod" name = "insta-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/insta" { + capabilities = ["list"] + } + path "secret/data/secretspec/insta/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_dev will be updated in-place ! resource "vault_policy" "link-shortener_dev" { id = "link-shortener-dev" name = "link-shortener-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/link-shortener" { + capabilities = ["list"] + } + path "secret/data/secretspec/link-shortener/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_prod will be updated in-place ! resource "vault_policy" "link-shortener_prod" { id = "link-shortener-prod" name = "link-shortener-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/link-shortener" { + capabilities = ["list"] + } + path "secret/data/secretspec/link-shortener/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_dev will be updated in-place ! resource "vault_policy" "lost-and-found_dev" { id = "lost-and-found-dev" name = "lost-and-found-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/lost-and-found" { + capabilities = ["list"] + } + path "secret/data/secretspec/lost-and-found/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_prod will be updated in-place ! resource "vault_policy" "lost-and-found_prod" { id = "lost-and-found-prod" name = "lost-and-found-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/lost-and-found" { + capabilities = ["list"] + } + path "secret/data/secretspec/lost-and-found/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_dev will be updated in-place ! resource "vault_policy" "maps_dev" { id = "maps-dev" name = "maps-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/maps" { + capabilities = ["list"] + } + path "secret/data/secretspec/maps/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_prod will be updated in-place ! resource "vault_policy" "maps_prod" { id = "maps-prod" name = "maps-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/maps" { + capabilities = ["list"] + } + path "secret/data/secretspec/maps/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_dev will be updated in-place ! resource "vault_policy" "occ-main_dev" { id = "occ-main-dev" name = "occ-main-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/occ-main" { + capabilities = ["list"] + } + path "secret/data/secretspec/occ-main/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_prod will be updated in-place ! resource "vault_policy" "occ-main_prod" { id = "occ-main-prod" name = "occ-main-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/occ-main" { + capabilities = ["list"] + } + path "secret/data/secretspec/occ-main/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_dev will be updated in-place ! resource "vault_policy" "quest_dev" { id = "quest-dev" name = "quest-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/quest" { + capabilities = ["list"] + } + path "secret/data/secretspec/quest/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_prod will be updated in-place ! resource "vault_policy" "quest_prod" { id = "quest-prod" name = "quest-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/quest" { + capabilities = ["list"] + } + path "secret/data/secretspec/quest/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_dev will be updated in-place ! resource "vault_policy" "scottylabs-org_dev" { id = "scottylabs-org-dev" name = "scottylabs-org-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/scottylabs-org" { + capabilities = ["list"] + } + path "secret/data/secretspec/scottylabs-org/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_prod will be updated in-place ! resource "vault_policy" "scottylabs-org_prod" { id = "scottylabs-org-prod" name = "scottylabs-org-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/scottylabs-org" { + capabilities = ["list"] + } + path "secret/data/secretspec/scottylabs-org/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-rfcs_dev will be updated in-place ! resource "vault_policy" "slai-rfcs_dev" { id = "slai-rfcs-dev" name = "slai-rfcs-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/slai-rfcs" { + capabilities = ["list"] + } + path "secret/data/secretspec/slai-rfcs/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-rfcs_prod will be updated in-place ! resource "vault_policy" "slai-rfcs_prod" { id = "slai-rfcs-prod" name = "slai-rfcs-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/slai-rfcs" { + capabilities = ["list"] + } + path "secret/data/secretspec/slai-rfcs/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_dev will be updated in-place ! resource "vault_policy" "study_dev" { id = "study-dev" name = "study-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/study" { + capabilities = ["list"] + } + path "secret/data/secretspec/study/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_prod will be updated in-place ! resource "vault_policy" "study_prod" { id = "study-prod" name = "study-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/study" { + capabilities = ["list"] + } + path "secret/data/secretspec/study/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_dev will be updated in-place ! resource "vault_policy" "tartan-vote_dev" { id = "tartan-vote-dev" name = "tartan-vote-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/tartan-vote" { + capabilities = ["list"] + } + path "secret/data/secretspec/tartan-vote/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_prod will be updated in-place ! resource "vault_policy" "tartan-vote_prod" { id = "tartan-vote-prod" name = "tartan-vote-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/tartan-vote" { + capabilities = ["list"] + } + path "secret/data/secretspec/tartan-vote/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_dev will be updated in-place ! resource "vault_policy" "terrier_dev" { id = "terrier-dev" name = "terrier-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/terrier" { + capabilities = ["list"] + } + path "secret/data/secretspec/terrier/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_prod will be updated in-place ! resource "vault_policy" "terrier_prod" { id = "terrier-prod" name = "terrier-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/terrier" { + capabilities = ["list"] + } + path "secret/data/secretspec/terrier/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 0 to add, 52 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 0 to add, 52 to change, 0 to destroy. --- ### Plan Summary 7 projects, 1 with changes, 0 with no changes, 6 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```
brightz force-pushed feat-openbao-lead-list from 2dc3b198ae
Some checks failed
atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.
Details
atlantis/plan: git Plan failed.
Details
atlantis/plan: discord Plan failed.
Details
atlantis/plan: google_groups Plan failed.
Details
atlantis/plan: slack Plan failed.
Details
atlantis/plan: keycloak Plan failed.
Details
atlantis/plan: google_play Plan failed.
Details
atlantis/plan: openbao Plan: 0 to add, 52 to change, 0 to destroy.
Details
atlantis/plan 6/7 projects failed to plan.
kennel/build skipped: no services or static sites defined
Details
to 96d89a35db
All checks were successful
atlantis/plan: openbao Plan: 0 to add, 52 to change, 0 to destroy.
Details
atlantis/plan 1/1 projects planned successfully.
kennel/build skipped: no services or static sites defined
Details
atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.
Details
atlantis/apply: openbao Apply succeeded.
Details
atlantis/apply 1/1 projects applied successfully.
2026-10-04 13:52:29 +00:00 Compare
scottylabs-bot commented 2026-10-04 13:52:37 +00:00
Owner
Copy link

Ran Plan for project: openbao dir: tofu/openbao workspace: default

Show Output 
Compiling governance-tfgen v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-tfgen)
   Compiling governance v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-cli)
    Finished `release` profile [optimized] target(s) in 4.23s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
! update in-place (current -> planned)

OpenTofu will perform the following actions:

  # vault_policy.bus-sign_dev will be updated in-place
! resource "vault_policy" "bus-sign_dev" {
        id     = "bus-sign-dev"
        name   = "bus-sign-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/bus-sign" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/bus-sign/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.bus-sign_prod will be updated in-place
! resource "vault_policy" "bus-sign_prod" {
        id     = "bus-sign-prod"
        name   = "bus-sign-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/bus-sign" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/bus-sign/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/bus-sign/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/bus-sign/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_dev will be updated in-place
! resource "vault_policy" "cal_dev" {
        id     = "cal-dev"
        name   = "cal-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cal" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cal/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cal_prod will be updated in-place
! resource "vault_policy" "cal_prod" {
        id     = "cal-prod"
        name   = "cal-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cal" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cal/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cal/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cal/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_dev will be updated in-place
! resource "vault_policy" "changelog_dev" {
        id     = "changelog-dev"
        name   = "changelog-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/changelog" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/changelog/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.changelog_prod will be updated in-place
! resource "vault_policy" "changelog_prod" {
        id     = "changelog-prod"
        name   = "changelog-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/changelog" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/changelog/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/changelog/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/changelog/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_dev will be updated in-place
! resource "vault_policy" "cmugpt-agent_dev" {
        id     = "cmugpt-agent-dev"
        name   = "cmugpt-agent-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-agent" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-agent/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-agent_prod will be updated in-place
! resource "vault_policy" "cmugpt-agent_prod" {
        id     = "cmugpt-agent-prod"
        name   = "cmugpt-agent-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-agent" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-agent/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-agent/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-agent/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_dev will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_dev" {
        id     = "cmugpt-mcp-server-dev"
        name   = "cmugpt-mcp-server-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-mcp-server" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-mcp-server/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-mcp-server_prod will be updated in-place
! resource "vault_policy" "cmugpt-mcp-server_prod" {
        id     = "cmugpt-mcp-server-prod"
        name   = "cmugpt-mcp-server-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-mcp-server" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-mcp-server/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-mcp-server/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_dev" {
        id     = "cmugpt-sms-surface-dev"
        name   = "cmugpt-sms-surface-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-sms-surface" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-sms-surface/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-sms-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-sms-surface_prod" {
        id     = "cmugpt-sms-surface-prod"
        name   = "cmugpt-sms-surface-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-sms-surface" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-sms-surface/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-sms-surface/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_dev will be updated in-place
! resource "vault_policy" "cmugpt-surface_dev" {
        id     = "cmugpt-surface-dev"
        name   = "cmugpt-surface-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-surface" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-surface/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.cmugpt-surface_prod will be updated in-place
! resource "vault_policy" "cmugpt-surface_prod" {
        id     = "cmugpt-surface-prod"
        name   = "cmugpt-surface-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/cmugpt-surface" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/cmugpt-surface/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/cmugpt-surface/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/cmugpt-surface/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_dev will be updated in-place
! resource "vault_policy" "components_dev" {
        id     = "components-dev"
        name   = "components-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/components" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/components/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.components_prod will be updated in-place
! resource "vault_policy" "components_prod" {
        id     = "components-prod"
        name   = "components-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/components" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/components/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/components/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/components/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_dev will be updated in-place
! resource "vault_policy" "courses_dev" {
        id     = "courses-dev"
        name   = "courses-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/courses" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/courses/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.courses_prod will be updated in-place
! resource "vault_policy" "courses_prod" {
        id     = "courses-prod"
        name   = "courses-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/courses" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/courses/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/courses/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/courses/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_dev will be updated in-place
! resource "vault_policy" "dalmatian_dev" {
        id     = "dalmatian-dev"
        name   = "dalmatian-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/dalmatian" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/dalmatian/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.dalmatian_prod will be updated in-place
! resource "vault_policy" "dalmatian_prod" {
        id     = "dalmatian-prod"
        name   = "dalmatian-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/dalmatian" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/dalmatian/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/dalmatian/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/dalmatian/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_dev will be updated in-place
! resource "vault_policy" "discord-verify_dev" {
        id     = "discord-verify-dev"
        name   = "discord-verify-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/discord-verify" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/discord-verify/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.discord-verify_prod will be updated in-place
! resource "vault_policy" "discord-verify_prod" {
        id     = "discord-verify-prod"
        name   = "discord-verify-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/discord-verify" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/discord-verify/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/discord-verify/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/discord-verify/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_dev will be updated in-place
! resource "vault_policy" "documentation_dev" {
        id     = "documentation-dev"
        name   = "documentation-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/documentation" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/documentation/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.documentation_prod will be updated in-place
! resource "vault_policy" "documentation_prod" {
        id     = "documentation-prod"
        name   = "documentation-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/documentation" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/documentation/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/documentation/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/documentation/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_dev will be updated in-place
! resource "vault_policy" "eats_dev" {
        id     = "eats-dev"
        name   = "eats-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/eats" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/eats/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.eats_prod will be updated in-place
! resource "vault_policy" "eats_prod" {
        id     = "eats-prod"
        name   = "eats-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/eats" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/eats/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/eats/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/eats/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_dev will be updated in-place
! resource "vault_policy" "groupme-mirror_dev" {
        id     = "groupme-mirror-dev"
        name   = "groupme-mirror-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/groupme-mirror" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/groupme-mirror/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.groupme-mirror_prod will be updated in-place
! resource "vault_policy" "groupme-mirror_prod" {
        id     = "groupme-mirror-prod"
        name   = "groupme-mirror-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/groupme-mirror" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/groupme-mirror/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/groupme-mirror/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/groupme-mirror/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_dev will be updated in-place
! resource "vault_policy" "housing_dev" {
        id     = "housing-dev"
        name   = "housing-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/housing" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/housing/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.housing_prod will be updated in-place
! resource "vault_policy" "housing_prod" {
        id     = "housing-prod"
        name   = "housing-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/housing" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/housing/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/housing/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/housing/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_dev will be updated in-place
! resource "vault_policy" "insta_dev" {
        id     = "insta-dev"
        name   = "insta-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/insta" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/insta/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.insta_prod will be updated in-place
! resource "vault_policy" "insta_prod" {
        id     = "insta-prod"
        name   = "insta-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/insta" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/insta/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/insta/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/insta/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_dev will be updated in-place
! resource "vault_policy" "link-shortener_dev" {
        id     = "link-shortener-dev"
        name   = "link-shortener-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/link-shortener" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/link-shortener/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.link-shortener_prod will be updated in-place
! resource "vault_policy" "link-shortener_prod" {
        id     = "link-shortener-prod"
        name   = "link-shortener-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/link-shortener" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/link-shortener/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/link-shortener/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/link-shortener/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_dev will be updated in-place
! resource "vault_policy" "lost-and-found_dev" {
        id     = "lost-and-found-dev"
        name   = "lost-and-found-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/lost-and-found" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/lost-and-found/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.lost-and-found_prod will be updated in-place
! resource "vault_policy" "lost-and-found_prod" {
        id     = "lost-and-found-prod"
        name   = "lost-and-found-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/lost-and-found" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/lost-and-found/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/lost-and-found/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/lost-and-found/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_dev will be updated in-place
! resource "vault_policy" "maps_dev" {
        id     = "maps-dev"
        name   = "maps-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/maps" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/maps/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.maps_prod will be updated in-place
! resource "vault_policy" "maps_prod" {
        id     = "maps-prod"
        name   = "maps-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/maps" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/maps/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/maps/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/maps/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_dev will be updated in-place
! resource "vault_policy" "occ-main_dev" {
        id     = "occ-main-dev"
        name   = "occ-main-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/occ-main" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/occ-main/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.occ-main_prod will be updated in-place
! resource "vault_policy" "occ-main_prod" {
        id     = "occ-main-prod"
        name   = "occ-main-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/occ-main" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/occ-main/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/occ-main/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/occ-main/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_dev will be updated in-place
! resource "vault_policy" "quest_dev" {
        id     = "quest-dev"
        name   = "quest-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/quest" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/quest/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.quest_prod will be updated in-place
! resource "vault_policy" "quest_prod" {
        id     = "quest-prod"
        name   = "quest-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/quest" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/quest/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/quest/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/quest/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_dev will be updated in-place
! resource "vault_policy" "scottylabs-org_dev" {
        id     = "scottylabs-org-dev"
        name   = "scottylabs-org-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/scottylabs-org" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/scottylabs-org/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.scottylabs-org_prod will be updated in-place
! resource "vault_policy" "scottylabs-org_prod" {
        id     = "scottylabs-org-prod"
        name   = "scottylabs-org-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/scottylabs-org" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/scottylabs-org/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/scottylabs-org/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/scottylabs-org/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-rfcs_dev will be updated in-place
! resource "vault_policy" "slai-rfcs_dev" {
        id     = "slai-rfcs-dev"
        name   = "slai-rfcs-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/slai-rfcs" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/slai-rfcs/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slai-rfcs_prod will be updated in-place
! resource "vault_policy" "slai-rfcs_prod" {
        id     = "slai-rfcs-prod"
        name   = "slai-rfcs-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/slai-rfcs" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/slai-rfcs/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slai-rfcs/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slai-rfcs/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_dev will be updated in-place
! resource "vault_policy" "study_dev" {
        id     = "study-dev"
        name   = "study-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/study" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/study/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.study_prod will be updated in-place
! resource "vault_policy" "study_prod" {
        id     = "study-prod"
        name   = "study-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/study" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/study/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/study/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/study/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_dev will be updated in-place
! resource "vault_policy" "tartan-vote_dev" {
        id     = "tartan-vote-dev"
        name   = "tartan-vote-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/tartan-vote" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/tartan-vote/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.tartan-vote_prod will be updated in-place
! resource "vault_policy" "tartan-vote_prod" {
        id     = "tartan-vote-prod"
        name   = "tartan-vote-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/tartan-vote" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/tartan-vote/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/tartan-vote/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/tartan-vote/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_dev will be updated in-place
! resource "vault_policy" "terrier_dev" {
        id     = "terrier-dev"
        name   = "terrier-dev"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/terrier" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/terrier/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.terrier_prod will be updated in-place
! resource "vault_policy" "terrier_prod" {
        id     = "terrier-prod"
        name   = "terrier-prod"
!       policy = <<-EOT
+           path "secret/metadata/secretspec" {
+             capabilities = ["list"]
+           }
+           
+           path "secret/metadata/secretspec/terrier" {
+             capabilities = ["list"]
+           }
+           
            path "secret/data/secretspec/terrier/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/terrier/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/terrier/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 0 to add, 52 to change, 0 to destroy.
  • ▶️ To apply this plan, comment: 
    atlantis apply -p openbao
  • 🚮 To delete this plan and lock, click here
  • 🔁 To plan this project again, comment: 
    atlantis plan -p openbao

Plan: 0 to add, 52 to change, 0 to destroy.

  • ⏩ To apply all unapplied plans from this Pull Request, comment: 
    atlantis apply
  • 🚮 To delete all plans and locks from this Pull Request, comment: 
    atlantis unlock
Ran Plan for project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Compiling governance-tfgen v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-tfgen) Compiling governance v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/486/default/crates/governance-cli) Finished `release` profile [optimized] target(s) in 4.23s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ! update in-place (current -> planned) OpenTofu will perform the following actions: # vault_policy.bus-sign_dev will be updated in-place ! resource "vault_policy" "bus-sign_dev" { id = "bus-sign-dev" name = "bus-sign-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/bus-sign" { + capabilities = ["list"] + } + path "secret/data/secretspec/bus-sign/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.bus-sign_prod will be updated in-place ! resource "vault_policy" "bus-sign_prod" { id = "bus-sign-prod" name = "bus-sign-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/bus-sign" { + capabilities = ["list"] + } + path "secret/data/secretspec/bus-sign/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/bus-sign/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/bus-sign/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_dev will be updated in-place ! resource "vault_policy" "cal_dev" { id = "cal-dev" name = "cal-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cal" { + capabilities = ["list"] + } + path "secret/data/secretspec/cal/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cal_prod will be updated in-place ! resource "vault_policy" "cal_prod" { id = "cal-prod" name = "cal-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cal" { + capabilities = ["list"] + } + path "secret/data/secretspec/cal/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cal/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cal/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_dev will be updated in-place ! resource "vault_policy" "changelog_dev" { id = "changelog-dev" name = "changelog-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/changelog" { + capabilities = ["list"] + } + path "secret/data/secretspec/changelog/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.changelog_prod will be updated in-place ! resource "vault_policy" "changelog_prod" { id = "changelog-prod" name = "changelog-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/changelog" { + capabilities = ["list"] + } + path "secret/data/secretspec/changelog/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/changelog/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/changelog/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_dev will be updated in-place ! resource "vault_policy" "cmugpt-agent_dev" { id = "cmugpt-agent-dev" name = "cmugpt-agent-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-agent" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-agent/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-agent_prod will be updated in-place ! resource "vault_policy" "cmugpt-agent_prod" { id = "cmugpt-agent-prod" name = "cmugpt-agent-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-agent" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-agent/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-agent/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-agent/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_dev will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_dev" { id = "cmugpt-mcp-server-dev" name = "cmugpt-mcp-server-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-mcp-server" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-mcp-server/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-mcp-server_prod will be updated in-place ! resource "vault_policy" "cmugpt-mcp-server_prod" { id = "cmugpt-mcp-server-prod" name = "cmugpt-mcp-server-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-mcp-server" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-mcp-server/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-mcp-server/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-mcp-server/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_dev" { id = "cmugpt-sms-surface-dev" name = "cmugpt-sms-surface-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-sms-surface" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-sms-surface/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-sms-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-sms-surface_prod" { id = "cmugpt-sms-surface-prod" name = "cmugpt-sms-surface-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-sms-surface" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-sms-surface/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-sms-surface/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-sms-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_dev will be updated in-place ! resource "vault_policy" "cmugpt-surface_dev" { id = "cmugpt-surface-dev" name = "cmugpt-surface-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-surface" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-surface/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.cmugpt-surface_prod will be updated in-place ! resource "vault_policy" "cmugpt-surface_prod" { id = "cmugpt-surface-prod" name = "cmugpt-surface-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/cmugpt-surface" { + capabilities = ["list"] + } + path "secret/data/secretspec/cmugpt-surface/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/cmugpt-surface/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/cmugpt-surface/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_dev will be updated in-place ! resource "vault_policy" "components_dev" { id = "components-dev" name = "components-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/components" { + capabilities = ["list"] + } + path "secret/data/secretspec/components/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.components_prod will be updated in-place ! resource "vault_policy" "components_prod" { id = "components-prod" name = "components-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/components" { + capabilities = ["list"] + } + path "secret/data/secretspec/components/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/components/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/components/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_dev will be updated in-place ! resource "vault_policy" "courses_dev" { id = "courses-dev" name = "courses-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/courses" { + capabilities = ["list"] + } + path "secret/data/secretspec/courses/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.courses_prod will be updated in-place ! resource "vault_policy" "courses_prod" { id = "courses-prod" name = "courses-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/courses" { + capabilities = ["list"] + } + path "secret/data/secretspec/courses/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/courses/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/courses/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_dev will be updated in-place ! resource "vault_policy" "dalmatian_dev" { id = "dalmatian-dev" name = "dalmatian-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/dalmatian" { + capabilities = ["list"] + } + path "secret/data/secretspec/dalmatian/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.dalmatian_prod will be updated in-place ! resource "vault_policy" "dalmatian_prod" { id = "dalmatian-prod" name = "dalmatian-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/dalmatian" { + capabilities = ["list"] + } + path "secret/data/secretspec/dalmatian/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/dalmatian/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/dalmatian/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_dev will be updated in-place ! resource "vault_policy" "discord-verify_dev" { id = "discord-verify-dev" name = "discord-verify-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/discord-verify" { + capabilities = ["list"] + } + path "secret/data/secretspec/discord-verify/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.discord-verify_prod will be updated in-place ! resource "vault_policy" "discord-verify_prod" { id = "discord-verify-prod" name = "discord-verify-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/discord-verify" { + capabilities = ["list"] + } + path "secret/data/secretspec/discord-verify/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/discord-verify/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/discord-verify/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_dev will be updated in-place ! resource "vault_policy" "documentation_dev" { id = "documentation-dev" name = "documentation-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/documentation" { + capabilities = ["list"] + } + path "secret/data/secretspec/documentation/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.documentation_prod will be updated in-place ! resource "vault_policy" "documentation_prod" { id = "documentation-prod" name = "documentation-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/documentation" { + capabilities = ["list"] + } + path "secret/data/secretspec/documentation/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/documentation/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/documentation/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_dev will be updated in-place ! resource "vault_policy" "eats_dev" { id = "eats-dev" name = "eats-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/eats" { + capabilities = ["list"] + } + path "secret/data/secretspec/eats/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.eats_prod will be updated in-place ! resource "vault_policy" "eats_prod" { id = "eats-prod" name = "eats-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/eats" { + capabilities = ["list"] + } + path "secret/data/secretspec/eats/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/eats/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/eats/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_dev will be updated in-place ! resource "vault_policy" "groupme-mirror_dev" { id = "groupme-mirror-dev" name = "groupme-mirror-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/groupme-mirror" { + capabilities = ["list"] + } + path "secret/data/secretspec/groupme-mirror/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.groupme-mirror_prod will be updated in-place ! resource "vault_policy" "groupme-mirror_prod" { id = "groupme-mirror-prod" name = "groupme-mirror-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/groupme-mirror" { + capabilities = ["list"] + } + path "secret/data/secretspec/groupme-mirror/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/groupme-mirror/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/groupme-mirror/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_dev will be updated in-place ! resource "vault_policy" "housing_dev" { id = "housing-dev" name = "housing-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/housing" { + capabilities = ["list"] + } + path "secret/data/secretspec/housing/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.housing_prod will be updated in-place ! resource "vault_policy" "housing_prod" { id = "housing-prod" name = "housing-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/housing" { + capabilities = ["list"] + } + path "secret/data/secretspec/housing/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/housing/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/housing/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_dev will be updated in-place ! resource "vault_policy" "insta_dev" { id = "insta-dev" name = "insta-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/insta" { + capabilities = ["list"] + } + path "secret/data/secretspec/insta/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.insta_prod will be updated in-place ! resource "vault_policy" "insta_prod" { id = "insta-prod" name = "insta-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/insta" { + capabilities = ["list"] + } + path "secret/data/secretspec/insta/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/insta/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/insta/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_dev will be updated in-place ! resource "vault_policy" "link-shortener_dev" { id = "link-shortener-dev" name = "link-shortener-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/link-shortener" { + capabilities = ["list"] + } + path "secret/data/secretspec/link-shortener/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.link-shortener_prod will be updated in-place ! resource "vault_policy" "link-shortener_prod" { id = "link-shortener-prod" name = "link-shortener-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/link-shortener" { + capabilities = ["list"] + } + path "secret/data/secretspec/link-shortener/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/link-shortener/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/link-shortener/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_dev will be updated in-place ! resource "vault_policy" "lost-and-found_dev" { id = "lost-and-found-dev" name = "lost-and-found-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/lost-and-found" { + capabilities = ["list"] + } + path "secret/data/secretspec/lost-and-found/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.lost-and-found_prod will be updated in-place ! resource "vault_policy" "lost-and-found_prod" { id = "lost-and-found-prod" name = "lost-and-found-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/lost-and-found" { + capabilities = ["list"] + } + path "secret/data/secretspec/lost-and-found/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/lost-and-found/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/lost-and-found/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_dev will be updated in-place ! resource "vault_policy" "maps_dev" { id = "maps-dev" name = "maps-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/maps" { + capabilities = ["list"] + } + path "secret/data/secretspec/maps/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.maps_prod will be updated in-place ! resource "vault_policy" "maps_prod" { id = "maps-prod" name = "maps-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/maps" { + capabilities = ["list"] + } + path "secret/data/secretspec/maps/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/maps/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/maps/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_dev will be updated in-place ! resource "vault_policy" "occ-main_dev" { id = "occ-main-dev" name = "occ-main-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/occ-main" { + capabilities = ["list"] + } + path "secret/data/secretspec/occ-main/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.occ-main_prod will be updated in-place ! resource "vault_policy" "occ-main_prod" { id = "occ-main-prod" name = "occ-main-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/occ-main" { + capabilities = ["list"] + } + path "secret/data/secretspec/occ-main/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/occ-main/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/occ-main/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_dev will be updated in-place ! resource "vault_policy" "quest_dev" { id = "quest-dev" name = "quest-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/quest" { + capabilities = ["list"] + } + path "secret/data/secretspec/quest/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.quest_prod will be updated in-place ! resource "vault_policy" "quest_prod" { id = "quest-prod" name = "quest-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/quest" { + capabilities = ["list"] + } + path "secret/data/secretspec/quest/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/quest/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/quest/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_dev will be updated in-place ! resource "vault_policy" "scottylabs-org_dev" { id = "scottylabs-org-dev" name = "scottylabs-org-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/scottylabs-org" { + capabilities = ["list"] + } + path "secret/data/secretspec/scottylabs-org/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.scottylabs-org_prod will be updated in-place ! resource "vault_policy" "scottylabs-org_prod" { id = "scottylabs-org-prod" name = "scottylabs-org-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/scottylabs-org" { + capabilities = ["list"] + } + path "secret/data/secretspec/scottylabs-org/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/scottylabs-org/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/scottylabs-org/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-rfcs_dev will be updated in-place ! resource "vault_policy" "slai-rfcs_dev" { id = "slai-rfcs-dev" name = "slai-rfcs-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/slai-rfcs" { + capabilities = ["list"] + } + path "secret/data/secretspec/slai-rfcs/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slai-rfcs_prod will be updated in-place ! resource "vault_policy" "slai-rfcs_prod" { id = "slai-rfcs-prod" name = "slai-rfcs-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/slai-rfcs" { + capabilities = ["list"] + } + path "secret/data/secretspec/slai-rfcs/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slai-rfcs/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slai-rfcs/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_dev will be updated in-place ! resource "vault_policy" "study_dev" { id = "study-dev" name = "study-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/study" { + capabilities = ["list"] + } + path "secret/data/secretspec/study/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.study_prod will be updated in-place ! resource "vault_policy" "study_prod" { id = "study-prod" name = "study-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/study" { + capabilities = ["list"] + } + path "secret/data/secretspec/study/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/study/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/study/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_dev will be updated in-place ! resource "vault_policy" "tartan-vote_dev" { id = "tartan-vote-dev" name = "tartan-vote-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/tartan-vote" { + capabilities = ["list"] + } + path "secret/data/secretspec/tartan-vote/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.tartan-vote_prod will be updated in-place ! resource "vault_policy" "tartan-vote_prod" { id = "tartan-vote-prod" name = "tartan-vote-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/tartan-vote" { + capabilities = ["list"] + } + path "secret/data/secretspec/tartan-vote/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/tartan-vote/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/tartan-vote/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_dev will be updated in-place ! resource "vault_policy" "terrier_dev" { id = "terrier-dev" name = "terrier-dev" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/terrier" { + capabilities = ["list"] + } + path "secret/data/secretspec/terrier/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.terrier_prod will be updated in-place ! resource "vault_policy" "terrier_prod" { id = "terrier-prod" name = "terrier-prod" ! policy = <<-EOT + path "secret/metadata/secretspec" { + capabilities = ["list"] + } + + path "secret/metadata/secretspec/terrier" { + capabilities = ["list"] + } + path "secret/data/secretspec/terrier/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/terrier/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/terrier/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 0 to add, 52 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 0 to add, 52 to change, 0 to destroy. --- * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```
brightz commented 2026-10-04 13:55:52 +00:00
Member
Copy link

atlantis apply

atlantis apply
scottylabs-bot commented 2026-10-04 13:55:54 +00:00
Owner
Copy link

Ran Apply for project: openbao dir: tofu/openbao workspace: default

Show Output 
Finished `release` profile [optimized] target(s) in 0.06s

╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI
│ configuration:
│  - svalabs/forgejo in /tmp/forgejo-provider
│ 
│ The behavior may therefore not match any released version of the provider
│ and applying changes may cause the state to become incompatible with
│ published releases.
╵
vault_policy.discord-verify_prod: Modifying... [id=discord-verify-prod]
vault_policy.slai-rfcs_dev: Modifying... [id=slai-rfcs-dev]
vault_policy.tartan-vote_dev: Modifying... [id=tartan-vote-dev]
vault_policy.bus-sign_prod: Modifying... [id=bus-sign-prod]
vault_policy.eats_prod: Modifying... [id=eats-prod]
vault_policy.insta_prod: Modifying... [id=insta-prod]
vault_policy.courses_prod: Modifying... [id=courses-prod]
vault_policy.insta_dev: Modifying... [id=insta-dev]
vault_policy.occ-main_prod: Modifying... [id=occ-main-prod]
vault_policy.discord-verify_dev: Modifying... [id=discord-verify-dev]
vault_policy.discord-verify_prod: Modifications complete after 0s [id=discord-verify-prod]
vault_policy.courses_prod: Modifications complete after 0s [id=courses-prod]
vault_policy.tartan-vote_dev: Modifications complete after 0s [id=tartan-vote-dev]
vault_policy.slai-rfcs_dev: Modifications complete after 0s [id=slai-rfcs-dev]
vault_policy.discord-verify_dev: Modifications complete after 0s [id=discord-verify-dev]
vault_policy.dalmatian_dev: Modifying... [id=dalmatian-dev]
vault_policy.cal_prod: Modifying... [id=cal-prod]
vault_policy.occ-main_prod: Modifications complete after 0s [id=occ-main-prod]
vault_policy.tartan-vote_prod: Modifying... [id=tartan-vote-prod]
vault_policy.insta_prod: Modifications complete after 0s [id=insta-prod]
vault_policy.slai-rfcs_prod: Modifying... [id=slai-rfcs-prod]
vault_policy.documentation_prod: Modifying... [id=documentation-prod]
vault_policy.insta_dev: Modifications complete after 0s [id=insta-dev]
vault_policy.eats_prod: Modifications complete after 0s [id=eats-prod]
vault_policy.bus-sign_prod: Modifications complete after 0s [id=bus-sign-prod]
vault_policy.cmugpt-surface_prod: Modifying... [id=cmugpt-surface-prod]
vault_policy.quest_dev: Modifying... [id=quest-dev]
vault_policy.housing_prod: Modifying... [id=housing-prod]
vault_policy.link-shortener_dev: Modifying... [id=link-shortener-dev]
vault_policy.cmugpt-surface_dev: Modifying... [id=cmugpt-surface-dev]
vault_policy.cal_prod: Modifications complete after 0s [id=cal-prod]
vault_policy.occ-main_dev: Modifying... [id=occ-main-dev]
vault_policy.dalmatian_dev: Modifications complete after 0s [id=dalmatian-dev]
vault_policy.components_dev: Modifying... [id=components-dev]
vault_policy.documentation_prod: Modifications complete after 0s [id=documentation-prod]
vault_policy.tartan-vote_prod: Modifications complete after 0s [id=tartan-vote-prod]
vault_policy.slai-rfcs_prod: Modifications complete after 0s [id=slai-rfcs-prod]
vault_policy.quest_dev: Modifications complete after 0s [id=quest-dev]
vault_policy.cmugpt-surface_prod: Modifications complete after 0s [id=cmugpt-surface-prod]
vault_policy.housing_dev: Modifying... [id=housing-dev]
vault_policy.scottylabs-org_prod: Modifying... [id=scottylabs-org-prod]
vault_policy.components_prod: Modifying... [id=components-prod]
vault_policy.cal_dev: Modifying... [id=cal-dev]
vault_policy.link-shortener_dev: Modifications complete after 0s [id=link-shortener-dev]
vault_policy.lost-and-found_dev: Modifying... [id=lost-and-found-dev]
vault_policy.cmugpt-agent_prod: Modifying... [id=cmugpt-agent-prod]
vault_policy.cmugpt-surface_dev: Modifications complete after 0s [id=cmugpt-surface-dev]
vault_policy.maps_prod: Modifying... [id=maps-prod]
vault_policy.housing_prod: Modifications complete after 0s [id=housing-prod]
vault_policy.bus-sign_dev: Modifying... [id=bus-sign-dev]
vault_policy.occ-main_dev: Modifications complete after 0s [id=occ-main-dev]
vault_policy.components_dev: Modifications complete after 0s [id=components-dev]
vault_policy.study_dev: Modifying... [id=study-dev]
vault_policy.changelog_prod: Modifying... [id=changelog-prod]
vault_policy.components_prod: Modifications complete after 0s [id=components-prod]
vault_policy.housing_dev: Modifications complete after 0s [id=housing-dev]
vault_policy.terrier_prod: Modifying... [id=terrier-prod]
vault_policy.terrier_dev: Modifying... [id=terrier-dev]
vault_policy.scottylabs-org_prod: Modifications complete after 0s [id=scottylabs-org-prod]
vault_policy.cal_dev: Modifications complete after 0s [id=cal-dev]
vault_policy.maps_dev: Modifying... [id=maps-dev]
vault_policy.bus-sign_dev: Modifications complete after 0s [id=bus-sign-dev]
vault_policy.cmugpt-sms-surface_dev: Modifying... [id=cmugpt-sms-surface-dev]
vault_policy.groupme-mirror_prod: Modifying... [id=groupme-mirror-prod]
vault_policy.lost-and-found_dev: Modifications complete after 0s [id=lost-and-found-dev]
vault_policy.eats_dev: Modifying... [id=eats-dev]
vault_policy.maps_prod: Modifications complete after 0s [id=maps-prod]
vault_policy.cmugpt-agent_prod: Modifications complete after 0s [id=cmugpt-agent-prod]
vault_policy.dalmatian_prod: Modifying... [id=dalmatian-prod]
vault_policy.link-shortener_prod: Modifying... [id=link-shortener-prod]
vault_policy.study_dev: Modifications complete after 0s [id=study-dev]
vault_policy.cmugpt-agent_dev: Modifying... [id=cmugpt-agent-dev]
vault_policy.changelog_prod: Modifications complete after 0s [id=changelog-prod]
vault_policy.terrier_prod: Modifications complete after 0s [id=terrier-prod]
vault_policy.terrier_dev: Modifications complete after 0s [id=terrier-dev]
vault_policy.quest_prod: Modifying... [id=quest-prod]
vault_policy.cmugpt-mcp-server_prod: Modifying... [id=cmugpt-mcp-server-prod]
vault_policy.maps_dev: Modifications complete after 0s [id=maps-dev]
vault_policy.changelog_dev: Modifying... [id=changelog-dev]
vault_policy.cmugpt-sms-surface_dev: Modifications complete after 0s [id=cmugpt-sms-surface-dev]
vault_policy.groupme-mirror_prod: Modifications complete after 0s [id=groupme-mirror-prod]
vault_policy.courses_dev: Modifying... [id=courses-dev]
vault_policy.cmugpt-mcp-server_dev: Modifying... [id=cmugpt-mcp-server-dev]
vault_policy.eats_dev: Modifications complete after 0s [id=eats-dev]
vault_policy.cmugpt-sms-surface_prod: Modifying... [id=cmugpt-sms-surface-prod]
vault_policy.scottylabs-org_dev: Modifying... [id=scottylabs-org-dev]
vault_policy.dalmatian_prod: Modifications complete after 0s [id=dalmatian-prod]
vault_policy.lost-and-found_prod: Modifying... [id=lost-and-found-prod]
vault_policy.link-shortener_prod: Modifications complete after 0s [id=link-shortener-prod]
vault_policy.groupme-mirror_dev: Modifying... [id=groupme-mirror-dev]
vault_policy.cmugpt-agent_dev: Modifications complete after 0s [id=cmugpt-agent-dev]
vault_policy.documentation_dev: Modifying... [id=documentation-dev]
vault_policy.quest_prod: Modifications complete after 0s [id=quest-prod]
vault_policy.cmugpt-mcp-server_prod: Modifications complete after 0s [id=cmugpt-mcp-server-prod]
vault_policy.study_prod: Modifying... [id=study-prod]
vault_policy.changelog_dev: Modifications complete after 0s [id=changelog-dev]
vault_policy.courses_dev: Modifications complete after 0s [id=courses-dev]
vault_policy.cmugpt-mcp-server_dev: Modifications complete after 0s [id=cmugpt-mcp-server-dev]
vault_policy.cmugpt-sms-surface_prod: Modifications complete after 0s [id=cmugpt-sms-surface-prod]
vault_policy.scottylabs-org_dev: Modifications complete after 0s [id=scottylabs-org-dev]
vault_policy.lost-and-found_prod: Modifications complete after 0s [id=lost-and-found-prod]
vault_policy.groupme-mirror_dev: Modifications complete after 0s [id=groupme-mirror-dev]
vault_policy.documentation_dev: Modifications complete after 0s [id=documentation-dev]
vault_policy.study_prod: Modifications complete after 0s [id=study-prod]

Apply complete! Resources: 0 added, 52 changed, 0 destroyed.
Ran Apply for project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Finished `release` profile [optimized] target(s) in 0.06s ╷ │ Warning: Provider development overrides are in effect │ │ The following provider development overrides are set in the CLI │ configuration: │ - svalabs/forgejo in /tmp/forgejo-provider │ │ The behavior may therefore not match any released version of the provider │ and applying changes may cause the state to become incompatible with │ published releases. ╵ vault_policy.discord-verify_prod: Modifying... [id=discord-verify-prod] vault_policy.slai-rfcs_dev: Modifying... [id=slai-rfcs-dev] vault_policy.tartan-vote_dev: Modifying... [id=tartan-vote-dev] vault_policy.bus-sign_prod: Modifying... [id=bus-sign-prod] vault_policy.eats_prod: Modifying... [id=eats-prod] vault_policy.insta_prod: Modifying... [id=insta-prod] vault_policy.courses_prod: Modifying... [id=courses-prod] vault_policy.insta_dev: Modifying... [id=insta-dev] vault_policy.occ-main_prod: Modifying... [id=occ-main-prod] vault_policy.discord-verify_dev: Modifying... [id=discord-verify-dev] vault_policy.discord-verify_prod: Modifications complete after 0s [id=discord-verify-prod] vault_policy.courses_prod: Modifications complete after 0s [id=courses-prod] vault_policy.tartan-vote_dev: Modifications complete after 0s [id=tartan-vote-dev] vault_policy.slai-rfcs_dev: Modifications complete after 0s [id=slai-rfcs-dev] vault_policy.discord-verify_dev: Modifications complete after 0s [id=discord-verify-dev] vault_policy.dalmatian_dev: Modifying... [id=dalmatian-dev] vault_policy.cal_prod: Modifying... [id=cal-prod] vault_policy.occ-main_prod: Modifications complete after 0s [id=occ-main-prod] vault_policy.tartan-vote_prod: Modifying... [id=tartan-vote-prod] vault_policy.insta_prod: Modifications complete after 0s [id=insta-prod] vault_policy.slai-rfcs_prod: Modifying... [id=slai-rfcs-prod] vault_policy.documentation_prod: Modifying... [id=documentation-prod] vault_policy.insta_dev: Modifications complete after 0s [id=insta-dev] vault_policy.eats_prod: Modifications complete after 0s [id=eats-prod] vault_policy.bus-sign_prod: Modifications complete after 0s [id=bus-sign-prod] vault_policy.cmugpt-surface_prod: Modifying... [id=cmugpt-surface-prod] vault_policy.quest_dev: Modifying... [id=quest-dev] vault_policy.housing_prod: Modifying... [id=housing-prod] vault_policy.link-shortener_dev: Modifying... [id=link-shortener-dev] vault_policy.cmugpt-surface_dev: Modifying... [id=cmugpt-surface-dev] vault_policy.cal_prod: Modifications complete after 0s [id=cal-prod] vault_policy.occ-main_dev: Modifying... [id=occ-main-dev] vault_policy.dalmatian_dev: Modifications complete after 0s [id=dalmatian-dev] vault_policy.components_dev: Modifying... [id=components-dev] vault_policy.documentation_prod: Modifications complete after 0s [id=documentation-prod] vault_policy.tartan-vote_prod: Modifications complete after 0s [id=tartan-vote-prod] vault_policy.slai-rfcs_prod: Modifications complete after 0s [id=slai-rfcs-prod] vault_policy.quest_dev: Modifications complete after 0s [id=quest-dev] vault_policy.cmugpt-surface_prod: Modifications complete after 0s [id=cmugpt-surface-prod] vault_policy.housing_dev: Modifying... [id=housing-dev] vault_policy.scottylabs-org_prod: Modifying... [id=scottylabs-org-prod] vault_policy.components_prod: Modifying... [id=components-prod] vault_policy.cal_dev: Modifying... [id=cal-dev] vault_policy.link-shortener_dev: Modifications complete after 0s [id=link-shortener-dev] vault_policy.lost-and-found_dev: Modifying... [id=lost-and-found-dev] vault_policy.cmugpt-agent_prod: Modifying... [id=cmugpt-agent-prod] vault_policy.cmugpt-surface_dev: Modifications complete after 0s [id=cmugpt-surface-dev] vault_policy.maps_prod: Modifying... [id=maps-prod] vault_policy.housing_prod: Modifications complete after 0s [id=housing-prod] vault_policy.bus-sign_dev: Modifying... [id=bus-sign-dev] vault_policy.occ-main_dev: Modifications complete after 0s [id=occ-main-dev] vault_policy.components_dev: Modifications complete after 0s [id=components-dev] vault_policy.study_dev: Modifying... [id=study-dev] vault_policy.changelog_prod: Modifying... [id=changelog-prod] vault_policy.components_prod: Modifications complete after 0s [id=components-prod] vault_policy.housing_dev: Modifications complete after 0s [id=housing-dev] vault_policy.terrier_prod: Modifying... [id=terrier-prod] vault_policy.terrier_dev: Modifying... [id=terrier-dev] vault_policy.scottylabs-org_prod: Modifications complete after 0s [id=scottylabs-org-prod] vault_policy.cal_dev: Modifications complete after 0s [id=cal-dev] vault_policy.maps_dev: Modifying... [id=maps-dev] vault_policy.bus-sign_dev: Modifications complete after 0s [id=bus-sign-dev] vault_policy.cmugpt-sms-surface_dev: Modifying... [id=cmugpt-sms-surface-dev] vault_policy.groupme-mirror_prod: Modifying... [id=groupme-mirror-prod] vault_policy.lost-and-found_dev: Modifications complete after 0s [id=lost-and-found-dev] vault_policy.eats_dev: Modifying... [id=eats-dev] vault_policy.maps_prod: Modifications complete after 0s [id=maps-prod] vault_policy.cmugpt-agent_prod: Modifications complete after 0s [id=cmugpt-agent-prod] vault_policy.dalmatian_prod: Modifying... [id=dalmatian-prod] vault_policy.link-shortener_prod: Modifying... [id=link-shortener-prod] vault_policy.study_dev: Modifications complete after 0s [id=study-dev] vault_policy.cmugpt-agent_dev: Modifying... [id=cmugpt-agent-dev] vault_policy.changelog_prod: Modifications complete after 0s [id=changelog-prod] vault_policy.terrier_prod: Modifications complete after 0s [id=terrier-prod] vault_policy.terrier_dev: Modifications complete after 0s [id=terrier-dev] vault_policy.quest_prod: Modifying... [id=quest-prod] vault_policy.cmugpt-mcp-server_prod: Modifying... [id=cmugpt-mcp-server-prod] vault_policy.maps_dev: Modifications complete after 0s [id=maps-dev] vault_policy.changelog_dev: Modifying... [id=changelog-dev] vault_policy.cmugpt-sms-surface_dev: Modifications complete after 0s [id=cmugpt-sms-surface-dev] vault_policy.groupme-mirror_prod: Modifications complete after 0s [id=groupme-mirror-prod] vault_policy.courses_dev: Modifying... [id=courses-dev] vault_policy.cmugpt-mcp-server_dev: Modifying... [id=cmugpt-mcp-server-dev] vault_policy.eats_dev: Modifications complete after 0s [id=eats-dev] vault_policy.cmugpt-sms-surface_prod: Modifying... [id=cmugpt-sms-surface-prod] vault_policy.scottylabs-org_dev: Modifying... [id=scottylabs-org-dev] vault_policy.dalmatian_prod: Modifications complete after 0s [id=dalmatian-prod] vault_policy.lost-and-found_prod: Modifying... [id=lost-and-found-prod] vault_policy.link-shortener_prod: Modifications complete after 0s [id=link-shortener-prod] vault_policy.groupme-mirror_dev: Modifying... [id=groupme-mirror-dev] vault_policy.cmugpt-agent_dev: Modifications complete after 0s [id=cmugpt-agent-dev] vault_policy.documentation_dev: Modifying... [id=documentation-dev] vault_policy.quest_prod: Modifications complete after 0s [id=quest-prod] vault_policy.cmugpt-mcp-server_prod: Modifications complete after 0s [id=cmugpt-mcp-server-prod] vault_policy.study_prod: Modifying... [id=study-prod] vault_policy.changelog_dev: Modifications complete after 0s [id=changelog-dev] vault_policy.courses_dev: Modifications complete after 0s [id=courses-dev] vault_policy.cmugpt-mcp-server_dev: Modifications complete after 0s [id=cmugpt-mcp-server-dev] vault_policy.cmugpt-sms-surface_prod: Modifications complete after 0s [id=cmugpt-sms-surface-prod] vault_policy.scottylabs-org_dev: Modifications complete after 0s [id=scottylabs-org-dev] vault_policy.lost-and-found_prod: Modifications complete after 0s [id=lost-and-found-prod] vault_policy.groupme-mirror_dev: Modifications complete after 0s [id=groupme-mirror-dev] vault_policy.documentation_dev: Modifications complete after 0s [id=documentation-dev] vault_policy.study_prod: Modifications complete after 0s [id=study-prod] Apply complete! Resources: 0 added, 52 changed, 0 destroyed. ``` </details>
brightz deleted branch feat-openbao-lead-list 2026-10-04 15:27:59 +00:00
brightz referenced this pull request from a commit 2026-10-04 15:27:59 +00:00
fix: grant leads list perms (#486)
scottylabs-bot commented 2026-10-04 15:28:01 +00:00
Owner
Copy link

Locks and plans deleted for the projects and workspaces modified in this pull request:

  • dir: tofu/openbao workspace: default
Locks and plans deleted for the projects and workspaces modified in this pull request: - dir: `tofu/openbao` workspace: `default`
etashj referenced this pull request from a commit 2026-10-13 21:49:38 +00:00
fix: grant leads list perms (#486)
Sign in to join this conversation.
Reviewers
No reviewers
anish
Labels
Clear labels   
needs/linking
Issue is pending on account linking

  
needs/docs
Must have documentation written

  
needs/research
Discuss the ideal implementation with the tech lead

  
needs/upstream
Needs a contribution to an upstream project

  
type/bug
Something not working as intended

  
type/external
Lives outside of code

  
type/feature
New functionality

  
type/refactor
Improving existing code

  
urgency
high
 This is currently causing issues

  
urgency
immediate
 This is making a project or feature unusable

  
urgency
low
 This can happen whenever

  
urgency
medium
 This is expected to cause issues soon

No labels
needs/linking
needs/docs
needs/research
needs/upstream
type/bug
type/external
type/feature
type/refactor
urgency
high
urgency
immediate
urgency
low
urgency
medium
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
ScottyLabs/governance!486
No description provided.