# kv engine default (v1 in non dev mode)
path "secret/foo" {
  capabilities = ["read"]
}

# vault config source kv engine v1
path "secret/config" {
  capabilities = ["read"]
}

# vault config source kv engine v1 with multi paths
path "secret/multi/*" {
  capabilities = ["read"]
}

# kv engine v2
path "secret-v2/data/foo" {
  capabilities = ["read"]
}

# vault config source kv engine v2
path "secret-v2/data/config" {
  capabilities = ["read"]
}

# dynamic secrets
path "database/creds/mydbrole" {
  capabilities = [ "read" ]
}

# transit
path "transit/*" {
  capabilities = [ "create", "read", "update" ]
}
#path "transit/encrypt/my-key" {
#  capabilities = [ "read", "update" ]
#}
#path "transit/decrypt/my-key" {
#  capabilities = [ "read", "update" ]
#}
#path "transit/sign/my-sign-key" {
#  capabilities = [ "read", "update" ]
#}