I’ve seen that others have had apparent success using “vault operator migrate” to migrate vault & consul to new infrastructure. I’ve been trying to test that and am getting a 403 error
vault operator migrate -config migrate.hcl
2020-04-01T19:44:10.841Z [WARN] appending trailing forward slash to path
Error migrating: error writing entry: Unexpected response code: 403 (rpc error making call: Permission denied)
For a collection of reasons I am using the vault CLI on a 3rd VM which has valid network paths between the source and destination. Following the direction in https://www.vaultproject.io/docs/commands/operator/migrate/ the destination vault and consul are completely un-configured. Acl bootstrap has not been run and vault has not been touched. The source consul backend does have acl enabled, and I included the bootstrap token in the migrate.hcl as below:
storage_source “consul” {
address = “1.1.1.140:8500”
path = “vault/”
token = “acl_bootstrap_token”
}
storage_destination “consul” {
address = “2.2.2.2:8500”
path = “vault”
}
“consul members” and “consul info” to both source and dest return data.
How can I figure out what is giving me the 403 error?
Thanks - Mark