Skip to main content
In this tutorial, you’ll learn how to generate a new ACL token for the Consul agent on web-server-01, leveraging the existing eCommerce policy. We’ll cover:
  1. Reviewing existing ACL policies
  2. Creating a new token
  3. Automating token generation

​
1. Review Existing Policies

Before assigning a token, confirm which ACL policies exist in your Consul cluster.
Attempting to list policies without a valid token will result in a permission error.
Supply the bootstrap token to view the policy definitions:

​
Sample Output

​
2. Create a New Token

Now generate a scoped ACL token bound to your eCommerce policy. Replace the -policy-id value with the actual Policy ID obtained above.

​
Expected Response

The SecretID value is the actual token you will configure on web-server-01 for secure Consul access.

​
3. Automating Token Generation

For large-scale or production environments, manual token creation can become error-prone. Consider using HashiCorp Vault’s Consul secrets engine to dynamically issue ACL tokens:
  • Define roles in Vault that map to Consul policies.
  • Vault will automatically provision short-lived tokens.
  • Centralize token lifecycle management and auditing.
Dynamic token issuance reduces manual errors, enforces least privilege, and simplifies rotation.

​
Policy Overview

Watch Video

Practice Lab