🌍 HCL (Terraform)medium
3. Deny a sensitive subpath
Write TWO path blocks: 1. Allow `read` on `secret/data/app/*`. 2. Explicitly DENY all access to `secret/data/app/admin` (a more specific path) by giving it the single capability `deny`.
How to approach this
The `deny` capability overrides any allow — even a broad glob grant. Vault also prefers the MOST SPECIFIC matching policy path, so a narrow `secret/data/app/admin` block with `deny` protects that one secret while the wildcard still allows the rest. This is how you carve an exception out of a broad grant.
main.tf