acme-to-vault/vault/policies/acme-to-vault.hcl

path "[[ .vault.root ]]kv/data/service/+/certs/*" {
  capabilities = ["read","create","update"]
}
path "[[ .vault.root ]]kv/metadata/service/+/certs" {
  capabilities = ["list","read"]
}

path "[[ .vault.root ]]kv/data/service/[[ .instance ]]/account/*" {
  capabilities = ["read","create","update"]
}
path "[[ .vault.root ]]kv/metadata/service/[[ .instance ]]/account/*" {
  capabilities = ["list","read"]
}

path "[[ .vault.root ]]kv/data/service/[[ .instance ]]" {
  capabilities = ["read"]
}