# Query what tokens have root policy attached

**URL:** <https://discuss.hashicorp.com/t/query-what-tokens-have-root-policy-attached/9653>\
**Category:** Vault\
**Tags:** vault\
**Created:** [June 5, 2020, 8:00pm UTC](https://discuss.hashicorp.com/t/query-what-tokens-have-root-policy-attached/9653 "2020-06-05T20:00:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![michaelplemmons](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/michaelplemmons/32/7659_2.png) [@michaelplemmons](https://discuss.hashicorp.com/u/michaelplemmons)\
**Post date:** [June 5, 2020, 8:00pm UTC](https://discuss.hashicorp.com/t/query-what-tokens-have-root-policy-attached/9653/1 "2020-06-05T20:00:39Z")

</div>

I am working on an auditing question where I am asked to prove who has full right to our vault servers. I know myself and two of my team mates have the root policy attached to their token but how do i provide proof of that? Is there a way i can see who else has the root policy attached to their account?

---

<div class="post-metadata">

**Author:** ![Wolfsrudel](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/wolfsrudel/32/28465_2.png) [@Wolfsrudel](https://discuss.hashicorp.com/u/Wolfsrudel)\
**Post date:** [June 5, 2020, 8:10pm UTC](https://discuss.hashicorp.com/t/query-what-tokens-have-root-policy-attached/9653/2 "2020-06-05T20:10:21Z")

</div>

I found this one this week:

> **[Identifying Active HashiCorp Vault Root Tokens](https://www.greenreedtech.com/identifying-active-hashicorp-vault-root-tokens/)**
>
> Revoking the root token on a production HashiCorp Vault deployment is one of the recommended best practices for securing an instance of HashiCorp Vault. The actual process to revoke the root token …

Maybe it could help you out a little bit in your use case.

---

<div class="post-metadata">

**Author:** ![michaelplemmons](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/michaelplemmons/32/7659_2.png) [@michaelplemmons](https://discuss.hashicorp.com/u/michaelplemmons)\
**Post date:** [June 5, 2020, 8:18pm UTC](https://discuss.hashicorp.com/t/query-what-tokens-have-root-policy-attached/9653/3 "2020-06-05T20:18:42Z")

</div>

Thank you very much for the help.

---

<div class="post-metadata">

**Author:** ![michaelplemmons](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/michaelplemmons/32/7659_2.png) [@michaelplemmons](https://discuss.hashicorp.com/u/michaelplemmons)\
**Post date:** [July 2, 2020, 12:27pm UTC](https://discuss.hashicorp.com/t/query-what-tokens-have-root-policy-attached/9653/4 "2020-07-02T12:27:03Z")

</div>

It turns out that the Python script did not work for me. We have so many accessors in our vault that the scripts times out. Here is how we got around it.

1. First get the list of the accessors  
`vault list auth/token/accessors > all_accessors.txt`

2. The Python script would not return the values properly when we did have the accessors list so I wrote this shell script instead.

```auto
#!/usr/bin/env bash
# Get list of all accessors
#vault list auth/token/accessors > all_accessors.txt

echo "Token,DisplayName,CreateTime,ExpireTime,Policies" > vault_admins.txt

# make sure tokens starts out empty`
# shellcheck disable=SC2188
> tokens.txt

# jq command to join an array - https://stackoverflow.com/a/32276111
# the .? - https://unix.stackexchange.com/a/530363
while read -r token; do

  echo -n "\"${token}\"," | tee -a tokens.txt
  payload="{\"accessor\": \"${token}\"}"

  curl \
      -s --header "X-Vault-Token: ${VAULT_TOKEN}" \
      --request POST \
      --data "${payload}" \
      "${VAULT_ADDR}/v1/auth/token/lookup-accessor" | \
      jq -r '
        .? |
        [
          .data.display_name,
          (.data.creation_time | tostring),
          (.data.expire_time | tostring),
          (.data.policies | join("|"))
        ] | @csv
      ' | tee -a tokens.txt

  echo | tee -a tokens.txt
  sleep .2
done < all_accessors.txt

grep ',root' tokens.txt >> vault_admins.txt

```

---

<div class="post-metadata">

**Author:** ![michaelplemmons](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/michaelplemmons/32/7659_2.png) [@michaelplemmons](https://discuss.hashicorp.com/u/michaelplemmons)\
**Post date:** [September 29, 2020, 9:13pm UTC](https://discuss.hashicorp.com/t/query-what-tokens-have-root-policy-attached/9653/5 "2020-09-29T21:13:34Z")

</div>

`vault list auth/token/accessors` will fail if there are too many tokens. You will get a `Error listing auth/token/accessors/: context deadline exceeded` error if it takes too long.

If that is the case you may have to increase the max duration. I have not had a chance to test this.

> **[Server Configuration | Vault by HashiCorp](https://www.vaultproject.io/docs/configuration#default_max_request_duration)**
>
> Vault server configuration reference.

---

<div class="post-metadata">

**Author:** ![Wolfsrudel](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/wolfsrudel/32/28465_2.png) [@Wolfsrudel](https://discuss.hashicorp.com/u/Wolfsrudel)\
**Post date:** [October 19, 2020, 12:15pm UTC](https://discuss.hashicorp.com/t/query-what-tokens-have-root-policy-attached/9653/6 "2020-10-19T12:15:55Z")

</div>

What about this?

> **[vault-auditor Versions | HashiCorp Releases](https://releases.hashicorp.com/vault-auditor/)**

```auto
vault-auditor -h                                           
Usage: vault-auditor [--version] [--help] <command> [<args>]

Available commands are:
    parse Parse audit logs to find entity and token counts
    version Prints the vault-auditor version

```