To list and export the existing Vault Policies

Introduction

This guide explains how to list and export Vault policies in HashiCorp Vault, covering how to view all configured policies and export a specific one for review or backup. Vault uses policies to define what operations and paths users, applications, or systems can access — giving you fine-grained access control so you can separate responsibilities and secure secrets effectively.

---

Implementation

I. Prerequisites

Before you list and export Vault policies, make sure the following are in place:

1. Vault installation

• Vault must be installed and running on the target system
• The Vault server must be initialized and unsealed

2. Access credentials

• A Vault token with sufficient privileges to list and read policies

3. CLI access

• Access to the server or environment where Vault is running
• The vault CLI installed and available in your $PATH

4. Network and address configuration

• This guide assumes Vault is running locally at http://127.0.0.1:8200
• If TLS is disabled or self-signed certificates are used, the -tls-skip-verify flag must be provided

II. List All Vault Policies

To list all available policies in Vault, run:

vault policy list -address="http://127.0.0.1:8200" -tls-skip-verify

This command outputs every policy configured in Vault, including built-in policies like root and any custom ones you’ve created, such as example-policy.

Security note: -tls-skip-verify disables certificate validation, which is fine for local testing against self-signed certs but should be avoided against any production Vault instance — it leaves the connection open to man-in-the-middle interception. Use a properly signed certificate and drop this flag in production.

III. Export a Vault Policy

To view or export the details of a specific policy — example-policy in this example — run:

vault policy read -address="http://127.0.0.1:8200" -tls-skip-verify example-policy > example-policy.hcl

This reads the example-policy policy and writes it into a file named example-policy.hcl. That file can then be:

• Stored as a backup
• Versioned in Git alongside your infrastructure-as-code
• Modified and re-applied for future policy updates

IV. Conclusion

Learning to list and export Vault policies gives administrators a straightforward way to document, audit, and back up access control configuration. Regularly reviewing and exporting policies helps ensure Vault access control stays secure, auditable, and aligned with your organization’s requirements — especially useful before making changes, during security audits, or when migrating Vault configuration between environments.

---

Frequently Asked Questions

How do I apply an exported policy back into Vault? Use vault policy write <policy-name> <file>.hcl — for example, vault policy write example-policy example-policy.hcl re-applies the policy from the exported file.

Can I export all policies at once instead of one at a time? Not with a single built-in command — vault policy read operates on one policy per call. To export all of them, loop through the output of vault policy list and run vault policy read for each name, writing each to its own .hcl file.

What’s the difference between the built-in root policy and a custom policy? The root policy grants unrestricted access to every path in Vault and should be used sparingly, typically only for initial setup or emergency access. Custom policies, like example-policy, are scoped to specific paths and capabilities, following the principle of least privilege for day-to-day operations.

Related Articles:

How to Create and Revoke Vault Tokens Against a Policy