Write a Vault ACL policy with fine-grained capabilities including 'deny' override and required parameters

Steps

1. Write a policy HCL file that grants read/list on a path but denies access to a sub-path using the 'deny' capability: path 'secret/data/team/*' { capabilities = ["read", "list"] } path 'secret/data/team/restricted/*' { capabilities = ["deny"] }
2. Add a required_parameters constraint to prevent writes without a mandatory field: path 'secret/data/app/+/config' { capabilities = ["create", "update"] required_parameters = ["environment"] }
3. Add an allowed_parameters block to whitelist specific key-value pairs: path 'auth/approle/role/+/secret-id' { capabilities = ["update"] allowed_parameters = { "metadata" = [] } }
4. Write the policy to Vault: 'vault policy write myteam-policy myteam-policy.hcl'
5. Assign the policy to an AppRole token: 'vault write auth/approle/role/myapp token_policies=myteam-policy'
6. Test with 'vault token create -policy=myteam-policy' and attempt access to both the allowed and denied paths to verify