diff --git a/vault/policies/external-dns.hcl b/vault/policies/external-dns.hcl
new file mode 100644
index 0000000..867f827
--- /dev/null
+++ b/vault/policies/external-dns.hcl
@@ -0,0 +1,3 @@
+path "kv/data/external-dns" {
+  capabilities = ["read"]
+}