Table: nomad_acl_token - Query Nomad ACL Tokens using SQL
Nomad ACL Tokens are used in HashiCorp Nomad to provide a flexible, capability-based access control system. They allow operators to restrict access to certain data and APIs, making Nomad more secure. Each ACL token is associated with a set of policies, and these policies dictate the token's specific capabilities.
Table Usage Guide
The nomad_acl_token
table provides insights into ACL Tokens within HashiCorp Nomad. As a security analyst, explore token-specific details through this table, including associated policies, token type, and related metadata. Utilize it to uncover information about tokens, such as those with broad permissions, and to verify the security of your Nomad deployment.
Important Notes
- You need to specify the
secret_id
config argument in thenomad.spc
file to be able to query this table.
Examples
Basic info
Assess the elements within your Nomad ACL tokens to understand the different types, their global status, creation time, and expiration time-to-live (TTL). This can help manage and track the lifecycle and accessibility of each token.
select name, accessor_id, secret_id, type, global, create_time, expiration_ttlfrom nomad_acl_token;
select name, accessor_id, secret_id, type, global, create_time, expiration_ttlfrom nomad_acl_token;
List management tokens
Explore which management tokens are currently active in your system to understand their creation and expiration timelines. This can be beneficial for assessing your system's security by identifying potential vulnerabilities due to outdated or globally accessible tokens.
select name, accessor_id, secret_id, type, global, create_time, expiration_ttlfrom nomad_acl_tokenwhere type = 'management';
select name, accessor_id, secret_id, type, global, create_time, expiration_ttlfrom nomad_acl_tokenwhere type = 'management';
List global tokens
Explore which access control list (ACL) tokens in Nomad are set as global. This is useful in identifying potential security risks associated with globally accessible tokens.
select name, accessor_id, secret_id, type, global, create_time, expiration_ttlfrom nomad_acl_tokenwhere global;
select name, accessor_id, secret_id, type, global, create_time, expiration_ttlfrom nomad_acl_tokenwhere global = 1;
List tokens which will never expire
Uncover the details of access control list (ACL) tokens that have been set without an expiration time, thus identifying potential security risks due to tokens that will never expire. This is useful for maintaining secure practices by ensuring all tokens have a designated expiry.
select name, accessor_id, secret_id, type, global, create_time, expiration_ttlfrom nomad_acl_tokenwhere expiration_time is null;
select name, accessor_id, secret_id, type, global, create_time, expiration_ttlfrom nomad_acl_tokenwhere expiration_time is null;
List tokens which are not associated with any role
Discover the segments that consist of tokens which are not linked to any role. This is useful for identifying potential security risks, as these tokens may have been created without proper role assignments.
select name, accessor_id, secret_id, type, global, create_time, expiration_ttlfrom nomad_acl_tokenwhere roles is null;
select name, accessor_id, secret_id, type, global, create_time, expiration_ttlfrom nomad_acl_tokenwhere roles is null;
Schema for nomad_acl_token
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form, e.g. connection_name. | |
accessor_id | text | = | The accessor ID of the acl token. |
create_index | bigint | Create index of the acl token. | |
create_time | timestamp with time zone | The creation time of the acl token. | |
expiration_time | timestamp with time zone | The expiration time of the acl token. | |
expiration_ttl | text | The maximum life of the acl token. | |
global | boolean | Check whether the token is global or not. | |
modify_index | bigint | Modify index of the acl token. | |
name | text | = | The name of the acl token. |
policies | jsonb | Policies attached to the acl token. | |
roles | jsonb | Roles attached to the acl token. | |
secret_id | text | The secret ID of the acl token. | |
title | text | The title of the acl token. | |
type | text | The type of the acl token. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- nomad
You can pass the configuration to the command with the --config
argument:
steampipe_export_nomad --config '<your_config>' nomad_acl_token