# Consul ACL - Policies

**URL:** <https://discuss.hashicorp.com/t/consul-acl-policies/63778>\
**Category:** Consul\
**Tags:** acl\
**Created:** [March 18, 2024, 8:19am UTC](https://discuss.hashicorp.com/t/consul-acl-policies/63778 "2024-03-18T08:19:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sphtd](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sphtd/32/37962_2.png) [@sphtd](https://discuss.hashicorp.com/u/sphtd)\
**Post date:** [March 18, 2024, 8:19am UTC](https://discuss.hashicorp.com/t/consul-acl-policies/63778/1 "2024-03-18T08:19:15Z")

</div>

I mainly care about these assumptions:

- Everyone has access to the GUI without a token
- CLI/API is only available with a token.

Question: Is this setting possible?

---

<div class="post-metadata">

**Author:** ![Ranjandas](https://avatars.discourse-cdn.com/v4/letter/r/90ced4/32.png) [@Ranjandas](https://discuss.hashicorp.com/u/Ranjandas)\
**Post date:** [March 18, 2024, 10:38am UTC](https://discuss.hashicorp.com/t/consul-acl-policies/63778/2 "2024-03-18T10:38:30Z")

</div>

Hi @sphtd,

There are two possible options that I can think of to achieve this:

Option 1:

- Update the `anonymous` token policy to have all the read permissions required to access the UI. This would allow anyone to access the UI (to the extent that the policy allows)
- The API and CLI would be accessible to anyone to what the anonymous token allows, and anything else would require a token.

Option 2:

This option is a bit stricter and closer to what you are looking for than option 1.

- Have dedicated servers for Hosting the Consul UI.
- Create a token with the policy that allows enough permission for the UI.
- On the Consul UI server, set the `acl.tokens.default` to the above token. This would allow anyone accessing the UI (through this server) to have permissions of the `default` token.
- Set up a reverse proxy that exposes the Consul UI (allowing only the `/ui` endpoint). This would enable access to the UI, but the API ( `/v1/` endpoint) should be blocked.
- Any CLI/API interaction should be with any of the other agents in the cluster, which would require a token (no anonymous access).

ref:

- [Create tokens for agent registration | Consul | HashiCorp Developer](https://developer.hashicorp.com/consul/docs/security/acl/tokens/create/create-a-ui-token)
- [Commands: ACL Set Agent Token | Consul | HashiCorp Developer](https://developer.hashicorp.com/consul/commands/acl/set-agent-token#default)
- [Agents - Configuration File Reference | Consul | HashiCorp Developer](https://developer.hashicorp.com/consul/docs/agent/config/config-files#acl_tokens_default)

---

<div class="post-metadata">

**Author:** ![sphtd](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sphtd/32/37962_2.png) [@sphtd](https://discuss.hashicorp.com/u/sphtd)\
**Post date:** [March 18, 2024, 11:59am UTC](https://discuss.hashicorp.com/t/consul-acl-policies/63778/3 "2024-03-18T11:59:12Z")

</div>

Hey,  
thanks for reply.

ad1.

```auto
data "consul_acl_token" "anonymous_token" {
  accessor_id = "00000000-0000-0000-0000-000000000002"
}

resource "consul_acl_policy" "anonymous_policy" {
  name = "anonymous_access_policy"
  description = "Allow anonymous access to Consul UI, deny access to Consul API and CLI"
  rules = jsonencode({
    key = {
      "" = {
        policy = "read"
      }
    },
    service_prefix = {
      "" = {
        policy = "read"
      }
    },
    key_prefix = {
      "" = {
        policy = "read"
      }
    },
    node_prefix = {
      "" = {
        policy = "read"
      }
    }
  })
}

resource "consul_acl_token_policy_attachment" "attachment" {
    token_id = "00000000-0000-0000-0000-000000000002"
    policy = "${consul_acl_policy.anonymous_policy.name}"
}

```

Unfortunately, I still don’t know how to simultaneously block operations via API (curl) and CLI and have access to the GUI at the same time.