itamae/cookbooks/vault/files/etc/vault.d/policies/consul-auto-config.hcl

{
  "path": {
    "identity/oidc/token/oidc-role": {
      "policy": "read"
    }
  }
}