6.10.3. Configure the Vault Expression Constraint

By default, reading and writing vault expressions are sensitive operations. Configuring the Vault Expression Constraint allows you to set either or both of those operations to being nonsensitive. Changing this constraint allows a greater number of roles to read and write vault expressions.

The vault expression constraint is found in the management model at /core-service=management/access=authorization/constraint=vault-expression.

To configure the vault expression constraint, use the write-attribute operation to set the attributes of configured-requires-write and configured-requires-read to true or false. By default these are not set and the values of default-requires-read and default-requires-write are used. The default values cannot be changed.

Example 6.7. Making writing to vault expressions a nonsensitive operation

[domain@localhost:9999 /] cd /core-service=management/access=authorization/constraint=vault-expression
[domain@localhost:9999 constraint=vault-expression] :write-attribute(name=configured-requires-write, value=false)
    "outcome" => "success",
    "result" => undefined,
    "server-groups" => {"main-server-group" => {"host" => {"master" => {
        "server-one" => {"response" => {"outcome" => "success"}},
        "server-two" => {"response" => {"outcome" => "success"}}
[domain@localhost:9999 constraint=vault-expression] :read-resource
    "outcome" => "success",
    "result" => {
        "configured-requires-read" => undefined,
        "configured-requires-write" => false,
        "default-requires-read" => true,
        "default-requires-write" => true
[domain@localhost:9999 constraint=vault-expression]

What roles will be able to read and write to vault expressions depending on this configuration is summarized in Table 6.3, “Vault Expression Constraint Configuration outcomes”.

Table 6.3. Vault Expression Constraint Configuration outcomes

Value requires-read requires-write


Read operation is sensitive.

Only Auditor, Administrator, and SuperUser can read.

Write operation is sensitive.

Only Administrator, and SuperUser can write.


Read operation is not sensitive.

All management users can read.

Write operation is not sensitive.

Monitor, Administrator, and SuperUser can write. Deployers can also write if the vault expression is in an Application Resource.