policy.yml

# Best practice is to not declare orthogonal variables in this policy, but this is a demo
# We could also auto-rotate these AWS secrets, but that's getting out of scope for this demo
- &variables
  - !variable aws/users/jenkins/access_key_id
  - !variable aws/users/jenkins/secret_access_key

- !policy
  id: jenkins
  annotations:
    description: Conjur policy for Jenkins
  body:
    # Layer of hosts
    - !layer &masters_layer
      id: masters
      annotations:
        description: Layer for Jenkins masters

    # Host factory for 'masters' layer
    - !host-factory
      id: masters
      annotations:
        description: Host Factory for Jenkins masters
      layer: [ *masters_layer ]

    # Permit the hosts in the 'masters' layer to fetch the secrets
    - !permit
      role: *masters_layer
      privileges: [ read, execute ]
      resources: *variables