Consul provider, what are minimum ACL rules in policy?

[ghost]

This issue was originally opened by @vasilij-icabbi as hashicorp/terraform#20966. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Hello,
I am using Consul provider with Terraform and I want it to be secured with Consul ACL token.

Question is: What are minimum required ACL rules for policy for Consul Provider to proper work?

Thank you

[remilapeyre]

Hi @vasilij-icabbi, if I understand correctly your question, this will depend on the resources and data-sources you want to use and the ACL configuration of your cluster.

I would start with a token with all privileges removed and add them as you need them. If you want to know which ACL is needed for a given resource, you can look at the "ACL Required" in the corresponding Consul HTTP API documentation.

Does this answer your question?

[vasilij-icabbi]

@remilapeyre Thank you for your reply. I use Consul provider for configuration only, so it needed only for KV storage.

I created policy with rule:

{
  "Name": "terraform-token",
  "Description": "Terraform Token Policy",
  "Rules": "key_prefix \"\" { policy = \"write\" }"
}

Created token, assigned policy with role above and provided it to terraform consul provider. And here it fails with 403.

Either I do something wrong or either consul provider does some API calls and requires more policy rules to function proper, this is why I ask if there are any minimal rules I have to set?

Worth to mention that my Consul ACL policy is deny by default.

[vasilij-icabbi]

Hello,
just checking if anyone can help me here?

[remilapeyre]

Hi @vasilij-icabbi, thanks for the ping.

Terraform currently needs to read the configuration of the agent to know which datacenter it is connected to. Can you confirm that it works with this policy?

{
  "Name": "terraform-token",
  "Description": "Terraform Token Policy",
  "Rules": "key_prefix \"\" { policy = \"write\" } agent_prefix \"\" { policy = \"read\" }"
}

If so I will look into removing this restriction.

[vasilij-icabbi]

Hello @remilapeyre , Thank you for your reply, that helped and I confirm that it works as intended, I can write into KV and read from it too.