🌍 HCL (Terraform)easy
1. A read-only Vault policy
Write a Vault policy that grants READ access to the KV v2 secret at: secret/data/app/config A policy is one or more `path "<path>" { capabilities = [...] }` blocks.
How to approach this
A Vault policy is written in HCL and is DEFAULT-DENY — a token can only do what a path block explicitly allows. The block is `path "<path>" { capabilities = ["read"] }`. Crucial KV v2 detail: the actual secret VALUES live under a `data/` segment in the API, so to read the secret shown in the UI as `secret/app/config` your policy path must be `secret/data/app/config`. Capabilities is a LIST of strings.
main.tf