使用Go搜索并更新HCL字符串，排查Vault策略权限合规性

Got it, let's tackle this problem: you need to programmatically search and update Vault policy HCL using Go to resolve your permission auditing bottleneck. Here's a step-by-step solution with code examples tailored to your use case:

1. Setup Dependencies #

First, install the required Go packages for HCL parsing/writing and (optionally) Vault API integration:

go get github.com/hashicorp/hcl/v2
go get github.com/hashicorp/vault/api # Only if you need to interact directly with Vault's API

2. Define Structs to Map Vault Policy HCL #

We'll create Go structs that mirror the structure of Vault's policy HCL, making it easy to parse and manipulate:

package main

import (
	"fmt"
	"os"

	"github.com/hashicorp/hcl/v2"
	"github.com/hashicorp/hcl/v2/gohcl"
	"github.com/hashicorp/hcl/v2/hclwrite"
)

// VaultPolicy represents the top-level structure of a Vault policy
type VaultPolicy struct {
	Paths []PathBlock `hcl:"path,block"`
}

// PathBlock represents a single path block in a Vault policy (e.g., path "/auth/token/create" { ... })
type PathBlock struct {
	Path         string   `hcl:"path,label"` // The path string (e.g., "/auth/token/create")
	Capabilities []string `hcl:"capabilities,attr"` // List of permissions for the path
}

3. Parse Existing Vault Policy #

You can parse policy content either from a local file, or directly from Vault's API. Below is an example using a string (replace this with content from vault policy read or the API):

func main() {
	// Example policy content (replace with your actual policy data)
	policyContent := `path "/auth/token/create" {
  capabilities = ["create", "update", "sudo"]
}
path "/auth/token/lookup" {
  capabilities = ["create", "update"]
}
path "/auth/token/renew" {
  capabilities = ["create", "update"]
}
path "/auth/token/revoke" {
  capabilities = ["delete", "update"]
}`

	// Parse the HCL content into an abstract syntax tree (AST)
	file, diag := hclwrite.ParseConfig([]byte(policyContent), "", hcl.Pos{Line: 1, Column: 1})
	if diag.HasErrors() {
		fmt.Printf("Failed to parse policy: %v\n", diag)
		return
	}

	// Decode the AST into our VaultPolicy struct for easy manipulation
	var policy VaultPolicy
	diag = gohcl.DecodeBody(file.Body(), nil, &policy)
	if diag.HasErrors() {
		fmt.Printf("Failed to decode policy: %v\n", diag)
		return
	}

4. Search & Update Permissions #

Now you can iterate through the policy paths to search for specific permissions or update them. For example, let's add the read capability to the /auth/token/lookup path, and check which paths have the sudo capability:

// Example 1: Add a new capability to a specific path
	targetPath := "/auth/token/lookup"
	newCapability := "read"

	for i, pathBlock := range policy.Paths {
		if pathBlock.Path == targetPath {
			// Avoid duplicate capabilities
			capExists := false
			for _, cap := range pathBlock.Capabilities {
				if cap == newCapability {
					capExists = true
					break
				}
			}
			if !capExists {
				policy.Paths[i].Capabilities = append(pathBlock.Capabilities, newCapability)
				fmt.Printf("Added '%s' capability to path '%s'\n", newCapability, targetPath)
			} else {
				fmt.Printf("Capability '%s' already exists for path '%s'\n", newCapability, targetPath)
			}
		}
	}

	// Example 2: Search for all paths with the "sudo" capability
	fmt.Println("\nPaths with 'sudo' capability:")
	for _, pathBlock := range policy.Paths {
		for _, cap := range pathBlock.Capabilities {
			if cap == "sudo" {
				fmt.Printf("- %s\n", pathBlock.Path)
				break
			}
		}
	}

5. Generate Updated HCL & Save/Upload #

Finally, convert the modified VaultPolicy struct back into valid HCL, and either save it to a file or push it back to Vault:

// Create a new HCL file and encode our updated policy into it
	newFile := hclwrite.NewEmptyFile()
	body := newFile.Body()
	gohcl.EncodeIntoBody(&policy, body)

	// Print the updated policy to console
	fmt.Println("\nUpdated Policy:")
	fmt.Println(string(newFile.Bytes()))

	// Optional: Save to a local file
	err := os.WriteFile("updated-admin-policy.hcl", newFile.Bytes(), 0644)
	if err != nil {
		fmt.Printf("Failed to write updated policy file: %v\n", err)
		return
	}

	// Optional: Push updated policy back to Vault using the API
	// client, err := api.NewClient(api.DefaultConfig())
	// if err != nil {
	// 	fmt.Printf("Failed to create Vault client: %v\n", err)
	// 	return
	// }
	// _, err = client.Logical().Write("sys/policy/service/admin", map[string]interface{}{
	// 	"policy": string(newFile.Bytes()),
	// })
	// if err != nil {
	// 	fmt.Printf("Failed to update policy in Vault: %v\n", err)
	// 	return
	// }
}

Key Notes #

• Preserving Comments: The above approach uses struct decoding, which doesn't preserve HCL comments. If you need to keep comments, you'll need to traverse the HCL AST directly instead of using gohcl.DecodeBody.
• Batch Processing: To audit/update all your Vault policies, use the Vault API to list all policies (client.Logical().List("sys/policies/acl")), then iterate through each one to read, modify, and write back.
• Idempotency: Always check if a capability already exists before adding it to avoid duplicate entries in the policy.

内容的提问来源于stack exchange，提问作者ehime