ACL Rules

This topic provides reference information for the types of access control list (ACL) rules you can create and how they affect access to datacenter resources. For details on how to create rules and group them into policies, see Policies.

Overview

The following table provides an overview of the resources you can use to create ACL rules.

The following resources are not covered by ACL policies:

• The Status API is used by servers when bootstrapping and exposes basic IP and port information about the servers, and does not allow modification of any state.
• The datacenter listing operation of the Catalog API similarly exposes the names of known Consul datacenters, and does not allow modification of any state.
• The service mesh CA roots endpoint exposes just the public TLS certificate which other systems can use to verify the TLS connection with Consul.

The following topics provide additional details about the available resources.

ACL Resource Rules

The acl resource controls access to ACL operations in the ACL API. Only one acl rule is allowed per policy. The value is set to one of the policy dispositions.

The acl = "write" rule is also required to create snapshots. This is because all token secrets are contained within the snapshot.

Rules for ACL resources do not use labels.

In the following example, the acl rule is configured with write access to the ACL API. The rule enables the operator to read or write ACLs, as well as discover the secret ID of any token.

acl = "write"

{
  "acl": "write"
}

Admin Partition Rules EnterpriseEnterprise

The partition and partition_prefix resource controls access to one or more admin partitions. You can include any number of namespace rules inside the admin partition.

In the following example, the policy grants write access to the ex-namespace namespace, as well as namespaces prefixed with exns- in the example partition. The mesh and peering resources are also scoped to the admin partition rule, which grants write access to the mesh and peering resources in the example partition.

In addition, the policy grants read access to the ex-namespace namespace, as well as namespaces prefixed with exns- in all partitions containing the example- prefix. Read access is granted for the mesh and peering resources scoped within the associated partition.

partition "example" {
  mesh = "write"
  peering = "write"

  node "my-node" {
    policy = "write"
  }

  namespace "ex-namespace" {
    policy = "write"
  }

  namespace_prefix "exns-" {
    policy = "write"
  }
}

partition_prefix "example-" {
  mesh = "read"
  peering = "read"

  node "my-node" {
    policy = "read"
  }

  namespace "ex-namespace" {
    policy = "read"
  }
}

{
  "partition": {
    "example": {
      "mesh": "write",
      "node": {
        "my-node": {
          "policy": "write"
        }
      },
      "namespace": {
        "ex-namespace": {
          "policy": "write"
        }
      },
      "namespace_prefix": {
        "exns-": {
          "policy": "write"
        }
      }
    }
  },
  "partition_prefix": {
    "example-": {
      "mesh": "read",
      "node": {
        "my-node": {
          "policy": "read"
        }
      },
      "namespace": {
        "ex-namespace": {
          "policy": "read"
        }
      }
    }
  }
}

Agent Rules

The agent and agent_prefix resources control access to the utility operations in the Agent API, such as join and leave. All of the catalog-related operations are covered by the node or node_prefix and service or service_prefix policies instead.

agent "foo" {
  policy = "write"
}
agent_prefix "" {
  policy = "read"
}
agent_prefix "bar" {
  policy = "deny"
}

{
  "agent": {
    "foo": {
      "policy": "write"
    }
  },
  "agent_prefix": {
    "": {
      "policy": "read"
    },
    "bar": {
      "policy": "deny"
    }
  }
}

Agent rules are keyed by the node name they apply to. In the example above the rules allow read-write access to the node with the exact name foo, read-only access to any node name by using the empty prefix, and denies all access to any node name that starts with bar.

Since Agent API utility operations may be required before an agent is joined to a cluster, or during an outage of the Consul servers or ACL datacenter, a special token may be configured with acl.tokens.agent_recovery to allow write access to these operations even if no ACL resolution capability is available.

Event Rules

The event and event_prefix resources control access to event operations in the Event API, such as firing events and listing events.

event_prefix "" {
  policy = "read"
}
event "deploy" {
  policy = "write"
}

{
  "event_prefix": {
    "": {
      "policy": "read"
    }
  },
  "event": {
    "deploy": {
      "policy": "write"
    }
  }
}

Event rules are labeled with the event name they apply to. In the example above, the rules allow read-only access to any event, and firing of the "deploy" event.

The consul exec command uses events with the "_rexec" prefix during operation, so to enable this feature in a Consul environment with ACLs enabled, you will need to give agents a token with access to this event prefix, in addition to configuring disable_remote_exec to false.

Identity Rules

The identity and identity_prefix resources control workload-identity-level registration and read access to the Catalog v2 API group. Specify the resource label in identity rules to set the scope of the rule. The resource label in the following example is empty. As a result, the rules allow read-only access to any workload identity name with the empty prefix. The rules also allow read-write access to the app identity and deny all access to the admin identity:

identity_prefix "" {
  policy = "read"
}
identity "app" {
  policy = "write"
}
identity "admin" {
  policy = "deny"
}

{
  "identity_prefix": {
    "": {
      "policy": "read"
    }
  },
  "identity": {
    "app": {
      "policy": "write"
    },
    "admin": {
      "policy": "deny"
    }
  }
}

Key/Value Rules

The key and key_prefix resources control access to key/value store operations in the KV API.

key_prefix "" {
  policy = "read"
}
key "foo" {
  policy = "write"
}
key "bar" {
  policy = "deny"
}

{
  "key_prefix": {
    "": {
      "policy": "read"
    }
  },
  "key": {
    "foo": {
      "policy": "write"
    },
    "bar": {
      "policy": "deny"
    }
  }
}

Key rules are labeled with the key name they apply to. In the example above, the rules allow read-only access to any key name with the empty prefix rule, allow read-write access to the "foo" key, and deny access to the "bar" key.

List Policy for Keys

Enable the list policy disposition (Consul 1.0+) by setting the acl.enable_key_list_policy parameter to true. The disposition provides recursive access to key entries. Refer to the KV API documentation for additional information.

In the following example, key resources that start with bar may be listed.

key_prefix "" {
 policy = "deny"
}

key_prefix "bar" {
 policy = "list"
}

key_prefix "baz" {
 policy = "read"
}

{
  "key_prefix": {
    "": {
      "policy": "deny"
    },
    "bar": {
      "policy": "list"
    },
    "baz": {
      "policy": "read"
    }
  }
}

In the example above, the rules allow reading the key "baz", and only allow recursive reads on the prefix "bar".

A token with write access on a prefix also has list access. A token with list access on a prefix also has read access on all its suffixes.

Sentinel Integration EnterpriseEnterprise

Consul Enterprise supports additional optional fields for key write policies for Sentinel integration.

key "foo" {
  policy = "write"
  sentinel {
      code = <<EOF
import "strings"
main = rule { strings.has_suffix(value, "bar") }
EOF
      enforcementlevel = "hard-mandatory"
  }
}

For more detailed information, see the Consul Sentinel documentation.

Keyring Rules

The keyring resource controls access to keyring operations in the Keyring API. Only one keyring policy is allowed per rule set. The value is set to one of the policy dispositions, but may be read and updated.

keyring = "write"

{
  "keyring": "write"
}

Mesh Rules

The mesh resource controls access to ingress gateways, terminating gateways, and mesh configuration entries.

In Consul Enterprise, mesh rules are scoped to an admin partition. Therefore, they can be nested in an admin partition rule but not a namespace rule.

The following rule grants read and write access:

mesh = "write"

{
  "mesh": "write"
}

See Admin Partition Rules for another example rule that uses the mesh resource.

Namespace Rules EnterpriseEnterprise

The namespace and namespace_prefix resource controls access to Consul namespaces. Namespaces define a scope of resources for which ACL rules apply. ACL rules, themselves, can then be defined to only to apply to specific namespaces.

The following examples describe how namespace rules can be defined in a policy:

namespace_prefix "" {
  # grants permission to create and edit all namespaces
  policy = "write"

  # grant service:read for all services in all namespaces
  service_prefix "" {
    policy = "read"
  }

  # grant node:read for all nodes in all namespaces
  node_prefix "" {
    policy = "read"
  }
}

namespace "foo" {
  # grants permission to manage ACLs only for the foo namespace
  acl = "write"

  # grants permission to create and edit the foo namespace
  policy = "write"

  # grants write permissions to the KV for namespace foo
  key_prefix "" {
    policy = "write"
  }

  # grants write permissions for sessions for namespace foo
  session_prefix "" {
    policy = "write"
  }

  # grants service:write for all services in the foo namespace
  service_prefix "" {
    policy = "write"
  }

  # grants node:read for all nodes
  node_prefix "" {
    policy = "read"
  }
}

{
  "namespace_prefix": {
    "": {
      "policy": "write",
      "service_prefix": {
        "": {
          "policy": "read"
        }
      },
      "node_prefix": {
        "": {
          "policy": "read"
        }
      }
    }
  },
  "namespace": {
    "foo": {
      "acl": "write",
      "policy": "write",
      "key_prefix": {
        "": {
          "policy": "write"
        }
      },
      "session_prefix": {
        "": {
          "policy": "write"
        }
      },
      "service_prefix": {
        "": {
          "policy": "write"
        }
      },
      "node_prefix": {
        "": {
          "policy": "read"
        }
      }
    }
  }
}

Restrictions

The following restrictions apply when a rule is defined in any user-created namespace:

1. operator rules are not allowed.
2. event rules are not allowed.
3. keyring rules are not allowed.
4. query rules are not allowed.
5. node rules that attempt to grant write privileges are not allowed.

These restrictions do not apply to the default namespace created by Consul. In general all of the above are permissions that only an operator should have and thus granting these permissions can only be done within the default namespace.

Implicit Namespacing

Rules and policies created within a namespace will inherit the namespace configuration. This means that rules and policies will be implicitly namespaced and do not need additional configuration. The restrictions outlined above will apply to these rules and policies. Additionally, rules and policies within a specific namespace are prevented from accessing resources in another namespace.

Node Rules

The node and node_prefix resources control access to the following API behaviors:

• node-level registration and read access to the Catalog API
• service discovery with the Health API
• filtering results in Agent API operations, such as fetching the list of cluster members.

You can use resource labels to scope the rule to a specific resource or set of resources.

The following example rule uses an empty prefix label, which provides read-only access to all nodes. The rule also provides read-write access to the app node and denies all access to the admin node:

node_prefix "" {
  policy = "read"
}
node "app" {
  policy = "write"
}
node "admin" {
  policy = "deny"
}

{
  "node_prefix": {
    "": {
      "policy": "read"
    }
  },
  "node": {
    "app": {
      "policy": "write"
    },
    "admin": {
      "policy": "deny"
    }
  }
}

Registering and Querying Node Information

Agents must be configured with write privileges for their own node name so that the agent can register their node metadata, tagged addresses, and other information in the catalog. If configured incorrectly, the agent will print an error to the console when it tries to sync its state with the catalog. Configure write access in the acl.tokens.agent parameter.

The acl.token.default used by the agent should have read access to a given node so that the DNS interface can be queried.

Node rules are used to filter query results when reading from the catalog or retrieving information from the health endpoints. This allows for configurations where a token has access to a given service name, but only on an allowed subset of node names.

Consul agents check tokens locally when health checks are registered and when Consul performs periodic anti-entropy syncs. These actions may required an ACL token to complete. Use the following methods to configure ACL tokens for registration events:

• Configure a global token in the acl.tokens.default parameter. This allows a single token to be used during all check registration operations.
• Provide an ACL token with service and check definitions at registration time. This allows for greater flexibility and enables the use of multiple tokens on the same agent. Refer to the services and checks documentation for examples. You can also pass tokens to the HTTP API for operations that require them.

Reading Imported Nodes

Nodes rules affect read access to nodes with services exported by exported-services configuration entries, including nodes imported from cluster peerings or admin partitions (Enterprise-only). Read access to all imported nodes is granted when either of the following rule sets are attached to a token:

• service:write is granted to any service.
• node:read is granted to all nodes.

For Consul Enterprise, either set of rules must be scoped to the requesting service's partition and at least one namespace.

You may need similarly scoped Service Rules to read Consul data, depending on the endpoint (e.g. /v1/health/service/:name). These permissions are satisfied when using a service identity.

Refer to Reading Services for example ACL policies used to read imported services using the health endpoint.

Operator Rules

The operator resource controls access to cluster-level operations in the Operator API, other than the Keyring API.

Only one operator rule allowed per rule set. In the following example, the token may be used to query the operator endpoints for diagnostic purposes but it will not make changes.

operator = "read"

{
  "operator": "read"
}

Peering Rules

The peering resource controls access to cluster peerings in the Cluster Peering API.

In Consul Enterprise, peering rules are scoped to an admin partition. Therefore, they can be nested in an admin partition rule but not a namespace rule.

The following rule grants read and write access:

peering = "write"

{
  "peering": "write"
}

For an example of how to apply rules for the peering resource alongside other rules, refer to the example configuration in Admin Partition Rules.

Prepared Query Rules

The query and query_prefix resources control access to create, update, and delete prepared queries in the Prepared Query API. Specify the resource label in query rules to determine the scope of the rule. The resource label in the following example is empty. As a result, the rules allow read-only access to query resources with any name. The rules also grant read-write access to the query named foo, which allows control of the query namespace to be delegated based on ACLs:

query_prefix "" {
  policy = "read"
}
query "foo" {
  policy = "write"
}

{
  "query_prefix": {
    "": {
      "policy": "read"
    }
  },
  "query": {
    "foo": {
      "policy": "write"
    }
  }
}

Executing queries is subject to node/node_prefix and service/service_prefix policies.

There are a few variations when using ACLs with prepared queries, each of which uses ACLs in one of two ways: open, protected by unguessable IDs or closed, managed by ACL policies. These variations are covered here, with examples:

• Static queries with no Name defined are not controlled by any ACL policies. These types of queries are meant to be ephemeral and not shared to untrusted clients, and they are only reachable if the prepared query ID is known. Since these IDs are generated using the same random ID scheme as ACL Tokens, it is infeasible to guess them. When listing all prepared queries, only a management token will be able to see these types, though clients can read instances for which they have an ID. An example use for this type is a query built by a startup script, tied to a session, and written to a configuration file for a process to use via DNS.

• Static queries with a Name defined are controlled by the query and query_prefix ACL resources. Clients are required to have an ACL token with permissions on to access that query name. Clients can list or read queries for which they have "read" access based on their prefix, and similar they can update any queries for which they have "write" access. An example use for this type is a query with a well-known name (eg. prod-primary-customer-db) that is used and known by many clients to provide geo-failover behavior for a database.

• Template queries queries work like static queries with a Name defined, except that a catch-all template with an empty Name requires an ACL token that can write to any query prefix.

When prepared queries are executed via DNS lookups or HTTP requests, the ACL checks are run against the service being queried, similar to how ACLs work with other service lookups. There are several ways the ACL token is selected for this check:

• If an ACL Token was captured when the prepared query was defined, it will be used to perform the service lookup. This allows queries to be executed by clients with lesser or even no ACL Token, so this should be used with care.

• If no ACL Token was captured, then the client's ACL Token will be used to perform the service lookup.

• If no ACL Token was captured and the client has no ACL Token, then the anonymous token will be used to perform the service lookup.

In the common case, the ACL Token of the invoker is used to test the ability to look up a service. If a Token was specified when the prepared query was created, the behavior changes and now the captured ACL Token set by the definer of the query is used when looking up a service.

Capturing ACL Tokens is analogous to PostgreSQL's SECURITY DEFINER attribute which can be set on functions, and using the client's ACL Token is similar to the complementary SECURITY INVOKER attribute.

Prepared queries were originally introduced in Consul 0.6.0. The ACL behavior remained unchanged through version 0.6.3, but versions after 0.6.3 included changes that improve management of the prepared query namespace.

These differences are outlined in the table below:

Service Rules

The service and service_prefix resources control service-level registration and read access to the Catalog API and service discovery with the Health API. Specify the resource label in service rules to set the scope of the rule. The resource label in the following example is empty. As a result, the rules allow read-only access to any service name with the empty prefix. The rules also allow read-write access to the app service and deny all access to the admin service:

service_prefix "" {
  policy = "read"
}
service "app" {
  policy = "write"
}
service "admin" {
  policy = "deny"
}

{
  "service_prefix": {
    "": {
      "policy": "read"
    }
  },
  "service": {
    "app": {
      "policy": "write"
    },
    "admin": {
      "policy": "deny"
    }
  }
}

Consul's DNS interface is affected by restrictions on service rules. If the acl.tokens.default used by the agent does not have read access to a given service, then the DNS interface will return no records when queried for it.

When reading from the catalog or retrieving information from the health endpoints, service rules are used to filter the results of the query.

Service rules come into play when using the Agent API to register services or checks. The agent will check tokens locally as a service or check is registered, and Consul also performs periodic anti-entropy syncs, which may require an ACL token to complete. To accommodate this, Consul provides two methods of configuring ACL tokens to use for registration events:

1. Using the acl.tokens.default configuration directive. This allows a single token to be configured globally and used during all service and check registration operations.
2. Providing an ACL token with service and check definitions at registration time. This allows for greater flexibility and enables the use of multiple tokens on the same agent. Examples of what this looks like are available for both services and checks. Tokens may also be passed to the HTTP API for operations that require them. Note that all tokens passed to an agent are persisted on local disk to allow recovery from restarts. Refer to -data-dir flag documentation for information about securing access.

In addition to ACLs, in Consul 0.9.0 and later, the agent must be configured with enable_script_checks or enable_local_script_checks set to true in order to enable script checks.

Reading Imported Services

Service rules affect read access to services exported by exported-services configuration entries, including services exported between cluster peerings or admin partitions (Enterprise-only). Read access to all imported services is granted when either of the following rule sets are attached to a token:

• service:write is granted to any service.
• service:read is granted to all services.

For Consul Enterprise, either set of rules must be scoped to the requesting service's partition and at least one namespace.

You may need similarly scoped Node Rules to read Consul data, depending on the endpoint (e.g. /v1/health/service/:name). These permissions are satisfied when using a service identity.

Refer to Reading Services for example ACL policies used to read imported services using the health endpoint.

Intentions

Service rules are also used to grant read or write access to intentions. The following policy provides read-write access to the "app" service, and explicitly grants intentions:read access to view intentions associated with the "app" service.

service "app" {
  policy = "write"
  intentions = "read"
}

{
  "service": {
    "app": {
      "policy": "write",
      "intentions": "read"
    }
  }
}

Refer to ACL requirements for intentions for more information about managing intentions access with service rules.

Session Rules

The session and session_prefix resources controls access to Session API operations.

Specify the resource label in session rules to set the scope of the rule. The resource label in the following example is empty. As a result, the rules allow read-only access to all sessions. The rules also allow creating sessions on the node named app and deny all access to any sessions on the admin node:

session_prefix "" {
  policy = "read"
}
session "app" {
  policy = "write"
}
session "admin" {
  policy = "deny"
}

{
  "session_prefix": {
    "": {
      "policy": "read"
    }
  },
  "session": {
    "app": {
      "policy": "write"
    },
    "admin": {
      "policy": "deny"
    }
  }
}