A team discovers that a Consul agent's ACL token was compromised. They immediately want to revoke that token and replace it with a new one. What is the correct sequence of operations?

Question

Accepted Answer

A. Delete the compromised token; create a new token with the same policies; run `consul acl set-agent-token agent `. To replace a compromised agent token: first delete (revoke) the compromised token using `consul acl token delete`; then create a replacement with the needed policies; finally, push the new token to the running agent using `consul acl set-agent-token agent ` without restarting the agent. Option b is wrong because restarting the agent does not revoke tokens; the compromised token would still be valid.

A team discovers that a Consul agent's ACL token was compromised. They immediately want to revoke that token and replace it with a new one. What is the correct sequence of operations?

Related Questions

Discussion