title: Permission denied on `vault kv put ...`
body: <p>I'm trying to perform a simple use case of creating a user and writing a kv secret using Vault v1.1.2:</p>
  
  <p>First I do some initial setup after starting the server in production mode:</p>
  
  <pre class="lang-sh prettyprint-override"><code>vault operator unseal &lt;unseal key&gt;
  vault operator unseal &lt;unseal key&gt;
  vault operator unseal &lt;unseal key&gt;
  
  export VAULT_ROOT_TOKEN=&lt;token&gt;
  </code></pre>
  
  <p>Next, I do some setup, including creating a policy:</p>
  
  <pre class="lang-sh prettyprint-override"><code>vault -version
  
  vault login $VAULT_ROOT_TOKEN
  
  vault auth enable userpass
  
  vault secrets enable -version=2 -path=secret kv
  
  vault policy write my-policy -&lt;&lt;EOF
  path "secret/*" {
    capabilities = ["create", "update"]
  }
  path "secret/foo" {
    capabilities = ["read"]
  }
  
  path "secret/data/*" {
    capabilities = ["create", "update"]
  }
  path "secret/data/foo" {
    capabilities = ["read"]
  }
  EOF
  
  vault token create -policy=my-policy
  </code></pre>
  
  <p>I then create a user:</p>
  
  <pre class="lang-sh prettyprint-override"><code>vault write auth/userpass/users/chris \
      password=password \
      policies=my-policy,default
  
  vault login -method=userpass username=chris password=password
  </code></pre>
  
  <p>Which returns:</p>
  
  <pre class="lang-sh prettyprint-override"><code>Success! You are now authenticated. The token information displayed below
  is already stored in the token helper. You do NOT need to run "vault login"
  again. Future Vault requests will automatically use this token.
  
  Key                    Value
  ---                    -----
  token                  ...
  token_accessor         ...
  token_duration         10h
  token_renewable        true
  token_policies         ["default" "my-policy"]
  identity_policies      []
  policies               ["default" "my-policy"]
  token_meta_username    chris
  </code></pre>
  
  <p>Next, I try writing a kv secret:</p>
  
  <pre class="lang-sh prettyprint-override"><code>vault kv put secret/foo my-value=s3cr3t
  </code></pre>
  
  <p>However, the error I get is:</p>
  
  <pre class="lang-sh prettyprint-override"><code>Error writing data to secret/data/foo: Error making API request.
  
  URL: PUT http://127.0.0.1:8200/v1/secret/data/foo
  Code: 403. Errors:
  
  * 1 error occurred:
      * permission denied
  </code></pre>
  
  <p>What am I missing?</p>