<p>Istio has returning &quot;RBAC: access denied&quot; when use wildcard path in &quot;AuthorizationPolicy&quot;, see files:</p>
<p><strong>api-key-test-authorization.yml</strong></p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: api-key-test-authorization
  namespace: test
spec:
  selector:
    matchLabels:
      api-key-secured: enabled
  rules:
  - to:
    - operation:
        paths: [&quot;*/test1&quot;, &quot;*/test2/*&quot;, &quot;*/test4*&quot;]
  - to:
    - operation:
        paths: [&quot;/*&quot;]
    when:
    - key: request.headers[api-key]
      values: [&quot;XXXXXXXX&quot;]
</code></pre>
<p><strong>Resources.java</strong></p>
<pre><code>...
enter code here
@GetMapping(value = &quot;/test1&quot;)
@ResponseBody
public ResponseEntity&lt;Resource&gt; getTest1(HttpServletResponse response) throws IOException {

    System.out.println(&quot;Test 1&quot;);

    return ResponseEntity.ok().build();
}

@GetMapping(value = &quot;/test2/{id}/xpto&quot;)
@ResponseBody
public ResponseEntity&lt;Resource&gt; getTest2(@PathVariable(&quot;id&quot;) String id, HttpServletResponse response) throws IOException {

    System.out.println(id + &quot; XPTO&quot;);

    return ResponseEntity.ok().build();
}

@GetMapping(value = &quot;/test3/{id}&quot;)
@ResponseBody
public ResponseEntity&lt;Resource&gt; getTest3(@PathVariable(&quot;id&quot;) String id, HttpServletResponse response) throws IOException {

    System.out.println(id + &quot; of Test 3&quot;);

    return ResponseEntity.ok().build();
}
</code></pre>
<p><strong>Results</strong>:</p>
<ul>
<li>&quot;http://example.com/test1&quot;: work's fine;</li>
<li>&quot;http://example.com/test2/xxx/xpto&quot;: return &quot;RBAC: access denied&quot;;</li>
<li>&quot;http://example.com/test3/xxx&quot;: return &quot;RBAC: access denied&quot;;</li>
</ul>
<p>These path are configured to not need to pass the &quot;api-key&quot;, however when there is a wildcard (*) in the path it returns the error demanding the &quot;api-key&quot;.</p>
<p>I'm using Istio.1.4.9</p>

<p>It seems that according to <a href="https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule" rel="nofollow noreferrer">documentation</a>, prefix <em>or</em> suffix matching is possible, but not both:</p>
<blockquote>
<p>Any string field in the rule supports Exact, Prefix, Suffix and Presence match:</p>
<ul>
<li>Exact match: “abc” will match on value “abc”.</li>
<li>Prefix match: “abc*” will match on value “abc” and “abcd”.</li>
<li>Suffix match: “*abc” will match on value “abc” and “xabc”.</li>
<li>Presence match: “*” will match when value is not empty.</li>
</ul>
</blockquote>
<p>Note that for your given URLs, prefix matching will probably be enough, as the domain part is not taken into account in this context.</p>
<p>Something like that (untested)</p>
<pre><code>paths: [&quot;test1&quot;, &quot;test2/*&quot;, &quot;test4*&quot;]
</code></pre>
