Table: nomad_acl_token - Query Nomad ACL Tokens using SQL

Nomad ACL Tokens are used in HashiCorp Nomad to provide a flexible, capability-based access control system. They allow operators to restrict access to certain data and APIs, making Nomad more secure. Each ACL token is associated with a set of policies, and these policies dictate the token's specific capabilities.

Table Usage Guide

The nomad_acl_token table provides insights into ACL Tokens within HashiCorp Nomad. As a security analyst, explore token-specific details through this table, including associated policies, token type, and related metadata. Utilize it to uncover information about tokens, such as those with broad permissions, and to verify the security of your Nomad deployment.

Important Notes

You need to specify the secret_id config argument in the nomad.spc file to be able to query this table.

Examples

Basic info

Assess the elements within your Nomad ACL tokens to understand the different types, their global status, creation time, and expiration time-to-live (TTL). This can help manage and track the lifecycle and accessibility of each token.

select
  name,
  accessor_id,
  secret_id,
  type,
  global,
  create_time,
  expiration_ttl
from
  nomad_acl_token;

select
  name,
  accessor_id,
  secret_id,
  type,
  global,
  create_time,
  expiration_ttl
from
  nomad_acl_token;

List management tokens

Explore which management tokens are currently active in your system to understand their creation and expiration timelines. This can be beneficial for assessing your system's security by identifying potential vulnerabilities due to outdated or globally accessible tokens.

select
  name,
  accessor_id,
  secret_id,
  type,
  global,
  create_time,
  expiration_ttl
from
  nomad_acl_token
where
  type = 'management';

select
  name,
  accessor_id,
  secret_id,
  type,
  global,
  create_time,
  expiration_ttl
from
  nomad_acl_token
where
  type = 'management';

List global tokens

Explore which access control list (ACL) tokens in Nomad are set as global. This is useful in identifying potential security risks associated with globally accessible tokens.

select
  name,
  accessor_id,
  secret_id,
  type,
  global,
  create_time,
  expiration_ttl
from
  nomad_acl_token
where
  global;

select
  name,
  accessor_id,
  secret_id,
  type,
  global,
  create_time,
  expiration_ttl
from
  nomad_acl_token
where
  global = 1;

List tokens which will never expire

Uncover the details of access control list (ACL) tokens that have been set without an expiration time, thus identifying potential security risks due to tokens that will never expire. This is useful for maintaining secure practices by ensuring all tokens have a designated expiry.

select
  name,
  accessor_id,
  secret_id,
  type,
  global,
  create_time,
  expiration_ttl
from
  nomad_acl_token
where
  expiration_time is null;

select
  name,
  accessor_id,
  secret_id,
  type,
  global,
  create_time,
  expiration_ttl
from
  nomad_acl_token
where
  expiration_time is null;

List tokens which are not associated with any role

Discover the segments that consist of tokens which are not linked to any role. This is useful for identifying potential security risks, as these tokens may have been created without proper role assignments.

select
  name,
  accessor_id,
  secret_id,
  type,
  global,
  create_time,
  expiration_ttl
from
  nomad_acl_token
where
  roles is null;

select
  name,
  accessor_id,
  secret_id,
  type,
  global,
  create_time,
  expiration_ttl
from
  nomad_acl_token
where
  roles is null;

Schema for nomad_acl_token

Name	Type	Operators	Description
_ctx	jsonb		Steampipe context in JSON form, e.g. connection_name.
accessor_id	text	=	The accessor ID of the acl token.
create_index	bigint		Create index of the acl token.
create_time	timestamp with time zone		The creation time of the acl token.
expiration_time	timestamp with time zone		The expiration time of the acl token.
expiration_ttl	text		The maximum life of the acl token.
global	boolean		Check whether the token is global or not.
modify_index	bigint		Modify index of the acl token.
name	text	=	The name of the acl token.
policies	jsonb		Policies attached to the acl token.
roles	jsonb		Roles attached to the acl token.
secret_id	text		The secret ID of the acl token.
title	text		The title of the acl token.
type	text		The type of the acl token.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- nomad

You can pass the configuration to the command with the --config argument:

steampipe_export_nomad --config '<your_config>' nomad_acl_token