scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-11-17 02:15:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: secrets-sync - move destination note (#26044)

Browse Source
This commit is contained in:
mickael-hc
2024-03-20 10:54:43 -04:00
committed by GitHub
parent 3106f26474
commit 55b4f1c42f
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
website/content/docs/sync/index.mdx
View File

@@ -129,6 +129,10 @@ The secret synced with the old granularity will be deleted and new secrets will
## Security ## Security
~> Note: Vault does not control the permissions at the destination. It is the responsibility
of the operator to configure and maintain proper access controls on the external system so synced
secrets are not accessed unintentionally.
### Vault access requirements ### Vault access requirements
Vault verifies the client has read access on the secret before syncing it with any destination. This additional check is Vault verifies the client has read access on the secret before syncing it with any destination. This additional check is
@@ -193,9 +197,6 @@ Likewise, if the client tries to sync this secret to any destination they will r
This read access verification is only done when creating or updating an association. Once the association is created, revoking This read access verification is only done when creating or updating an association. Once the association is created, revoking
read access to the policy that was used to sync the secret has no effect. read access to the policy that was used to sync the secret has no effect.
Vault does not control the permissions at the destination. It is the responsibility of the operator to configure proper
read access on the external system so synced secrets are not accessed unintentionally.
### Collisions and overwrites ### Collisions and overwrites
Secrets Sync operates with a last-write-wins strategy. If a secret with the same name already exists at the destination, Secrets Sync operates with a last-write-wins strategy. If a secret with the same name already exists at the destination,