2019-03-25 21:20:40 +00:00
|
|
|
---
|
2020-04-07 18:55:19 +00:00
|
|
|
layout: docs
|
|
|
|
|
page_title: ACL Guides
|
2020-04-13 18:40:26 +00:00
|
|
|
sidebar_title: Access Control (ACLs)
|
2020-04-07 18:55:19 +00:00
|
|
|
description: >-
|
|
|
|
|
Consul provides an optional Access Control List (ACL) system which can be used
|
|
|
|
|
to control access to data and APIs. Select the following guide for your use
|
|
|
|
|
case.
|
2019-03-25 21:20:40 +00:00
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# ACL Documentation and Guides
|
|
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
Consul uses Access Control Lists (ACLs) to secure the UI, API, CLI, service
|
|
|
|
|
communications, and agent communications. At the core, ACLs operate by grouping
|
|
|
|
|
rules into policies, then associating one or more policies with a token.
|
2019-03-25 21:20:40 +00:00
|
|
|
|
|
|
|
|
The following documentation and guides will help you understand and implement
|
|
|
|
|
ACLs.
|
|
|
|
|
|
|
|
|
|
## ACL Documentation
|
|
|
|
|
|
|
|
|
|
### ACL System
|
|
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
Consul provides an optional Access Control List (ACL) system which can be used
|
|
|
|
|
to control access to data and APIs. The ACL system is a Capability-based system
|
|
|
|
|
that relies on tokens which can have fine grained rules applied to them. The
|
2020-04-09 23:46:54 +00:00
|
|
|
[ACL System documentation](/docs/acl/acl-system) details the functionality
|
2019-05-02 17:29:20 +00:00
|
|
|
of Consul ACLs.
|
2019-03-25 21:20:40 +00:00
|
|
|
|
|
|
|
|
### ACL Rules
|
|
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
A core part of the ACL system is the rule language, which is used to describe
|
|
|
|
|
the policy that must be enforced. Read the ACL rules
|
2020-04-09 23:46:54 +00:00
|
|
|
[documentation](/docs/acl/acl-rules) to learn about rule specifications.
|
2019-03-25 21:20:40 +00:00
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
### ACL Auth Methods
|
2019-03-25 21:20:40 +00:00
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
An auth method is a component in Consul that performs authentication against a
|
|
|
|
|
trusted external party to authorize the creation of an ACL tokens usable within
|
|
|
|
|
the local datacenter. Read the ACL auth method
|
2020-05-13 19:14:03 +00:00
|
|
|
[documentation](/docs/acl/auth-methods) to learn more about how they
|
2019-05-02 17:29:20 +00:00
|
|
|
work and why you may want to use them.
|
2019-03-25 21:20:40 +00:00
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
### ACL Legacy System
|
2019-03-25 21:20:40 +00:00
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
The ACL system in Consul 1.3.1 and older is now called legacy. For information
|
|
|
|
|
on bootstrapping the legacy system, ACL rules, and a general ACL system
|
2020-04-09 23:46:54 +00:00
|
|
|
overview, read the legacy [documentation](/docs/acl/acl-legacy).
|
2019-03-25 21:20:40 +00:00
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
### ACL Migration
|
2019-03-25 21:20:40 +00:00
|
|
|
|
2020-04-09 23:46:54 +00:00
|
|
|
[The migration documentation](/docs/acl/acl-migrate-tokens) details how to
|
2019-05-02 17:29:20 +00:00
|
|
|
upgrade existing legacy tokens after upgrading to 1.4.0. It will briefly
|
|
|
|
|
describe what changed, and then walk through the high-level migration process
|
|
|
|
|
options, finally giving some specific examples of migration strategies. The new
|
|
|
|
|
ACL system has improvements for the security and management of ACL tokens and
|
|
|
|
|
policies.
|
2019-03-25 21:20:40 +00:00
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
## Learn ACL Guide
|
2019-03-25 21:20:40 +00:00
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
~> Note: the following guide is located on HashiCorp Learn. By selecting it,
|
|
|
|
|
you will be directed to a new site.
|
2019-03-25 21:20:40 +00:00
|
|
|
|
|
|
|
|
### Securing Consul with ACLs
|
|
|
|
|
|
2019-05-02 17:29:20 +00:00
|
|
|
In this guide, you will learn how to secure the UI, API, CLI, service
|
|
|
|
|
communications, and agent communications with ACLs. When securing your cluster
|
|
|
|
|
you should configure the ACLs first. The ACL documentation introduces basic
|
|
|
|
|
concepts and syntax for the ACL system, and we recommend that you read it
|
|
|
|
|
before you begin [this
|
|
|
|
|
guide](https://learn.hashicorp.com/consul/security-networking/production-acls).
|
