SaaS

Secure HashiCorp Cloud Platform with cnspec

Scan a HashiCorp Cloud Platform (HCP) organization and its Vault, Consul, Boundary, Packer, and Waypoint products against security and compliance best practices with cnspec.

Scan your HashiCorp Cloud Platform (HCP) organization to find security risks before they become incidents. cnspec connects to the HCP control plane and evaluates the posture of every project and the products provisioned beneath it: Vault Dedicated and Consul Dedicated clusters, Boundary clusters, the Packer registry, and Waypoint applications, along with the IAM service principals and access keys that authenticate to them.

If you're new to cnspec, start with the Quickstart. For an overview of every SaaS service cnspec can scan, see the SaaS scanning overview.

cnspec queries the HCP control plane (the management APIs behind the HCP portal). It reports each managed cluster's version, tier, region, and public-endpoint exposure. Cluster-internal configuration (Vault secret engines and policies, Consul ACLs and intentions, Boundary targets and grants) is served by each cluster's own API and is not covered here.

Prerequisites

To scan an HCP organization with cnspec, you must have:

Authenticate

cnspec connects to HCP using a service principal (a client ID and client secret). Grant the principal read access at the organization or project level, depending on the scope you want to scan.

To create a service principal and key:

  1. Log in to the HCP portal.
  2. Go to Access control (IAM) > Service principals.
  3. Create a service principal at the organization or project level and assign it a read-only role such as Viewer.
  4. Open the service principal and generate a key. Copy the Client ID and Client secret.

You can pass the credentials on the command line, or export them once and reuse them across commands:

export HCP_CLIENT_ID=YOUR_CLIENT_ID
export HCP_CLIENT_SECRET=YOUR_CLIENT_SECRET

Connection options

OptionDescription
--client-idHCP service principal client ID
--client-secretHCP service principal client secret
--org-idHCP organization ID (defaults to the service principal's organization)
--project-idHCP project ID, to scope the connection to a single project

You can also set the HCP_CLIENT_ID, HCP_CLIENT_SECRET, HCP_ORGANIZATION_ID, and HCP_PROJECT_ID environment variables to omit the matching flags.

Verify with a quick HCP check

Confirm that cnspec can reach your organization by opening a cnspec shell:

cnspec shell hcp --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET

If cnspec connects and shows a prompt, you're ready to scan.

Scan HCP

To scan your entire organization, use the cnspec scan command. Connecting to an organization discovers every project and, within each project, the Vault, Consul, and Boundary clusters, the Packer registry, and the Waypoint applications as child assets:

cnspec scan hcp --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET

To scope the scan to a single project, add --project-id:

cnspec scan hcp --project-id YOUR_PROJECT_ID --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET

When a scan completes, cnspec prints a summary of all the checks it ran, grouped by policy, along with a risk score from 0 (no risk) to 100 (highest risk). Failed checks include remediation guidance to help you fix issues. To learn more about reading scan results, read Understand cnspec Results.

You can write your own policies to check your HCP organization against the controls that matter to your organization.

Explore and test checks interactively

Open a cnspec shell to discover resources and try out checks:

cnspec shell hcp --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET

Retrieve the organization

cnspec> hcp.organization { id name state }
hcp.organization: {
  id: "a1b2c3d4-0000-0000-0000-000000000000"
  name: "example-org"
  state: "ACTIVE"
}

List projects

cnspec> hcp.projects { id name state }

List Vault clusters across all projects

cnspec> hcp.projects { name vaultClusters { id vaultVersion tier region publicEndpoint } }

List a project's Packer image buckets

cnspec> hcp.projects { name packerRegistry.buckets { name latestVersion platforms } }

Example security checks

Ensure no Vault cluster exposes a public endpoint

cnspec> hcp.projects.all(vaultClusters.all(publicEndpoint == false))
[ok] value: true

Ensure Consul clusters restrict access with an IP allowlist

cnspec> hcp.projects.all(consulClusters.all(ipAllowlist.length > 0))
[ok] value: true

Ensure Vault clusters stream audit logs

cnspec> hcp.projects.all(vaultClusters.all(auditLogExport != null))
[ok] value: true

Ensure the Packer registry is activated

cnspec> hcp.projects.all(packerRegistry.activated == true)
[ok] value: true

Flag organization-level service principals (prefer project scope)

cnspec> hcp.organization.servicePrincipals { name resourceName }

Ensure service principal keys are rotated regularly

cnspec> hcp.organization.servicePrincipals.all(keys.all(createdAt > time.now - 90*time.day))

Learn more

Vercel

Scan Vercel teams and projects against security and compliance best practices with cnspec.

Snowflake

Scan Snowflake accounts against security and compliance best practices with cnspec.

On this page

PrerequisitesAuthenticateConnection optionsVerify with a quick HCP checkScan HCPExplore and test checks interactivelyRetrieve the organizationList projectsList Vault clusters across all projectsList a project's Packer image bucketsExample security checksEnsure no Vault cluster exposes a public endpointEnsure Consul clusters restrict access with an IP allowlistEnsure Vault clusters stream audit logsEnsure the Packer registry is activatedFlag organization-level service principals (prefer project scope)Ensure service principal keys are rotated regularlyLearn more