HashiCorp Consul

Connect HashiCorp Consul to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In HashiCorp Consul:

   1. With a Consul ACL management token, create a read-only policy: consul acl policy create -name "safeguard-read" -description "Safeguard read-only" -rules 'agent_prefix "" \{ policy = "read" \}'.
   2. Create a token linked to it: consul acl token create -description "Safeguard" -policy-name safeguard-read.
   3. Copy the SecretID from the output; that is the API token (the AccessorID is only its public identifier).

   Where to find the other values:

   • Base URL: The HTTPS address of your Consul server's HTTP API, reachable from the internet.

   HashiCorp Consul issues this credential through its API or its support team, not through its admin screens.

   Source: developer.hashicorp.com, developer.hashicorp.com, developer.hashicorp.com, developer.hashicorp.com, checked 2026-10-07.

   The permissions Safeguard needs: agent:read.

2. On Compliance › Connectors, open HashiCorp Consul, click Connect, choose API token and fill in:

   Field	What to enter
   Base URL	Required. Your own server: an https address reachable from the internet.
   API token	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read HashiCorp Consul and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Cloud Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks