topic Re: Can a role only have write access to an index? in Security

Can a role only have write access to an index?

klim — Thu, 30 Mar 2023 21:41:42 GMT

Is it possible to limit a role to only have write access to an index?

For example I want a role to be able to do summary indexing via the collect command but I do not want them to have to be able to see what is in the index.

Re: Can a role only have write access to an index?

inventsekar — Fri, 31 Mar 2023 00:46:08 GMT

looks like its possible.. test it on test/dev system thoroughly.

https://docs.splunk.com/Documentation/Splunk/9.0.4/Security/Rolesandcapabilities

indexes_edit

Lets the user change any index settings such as file size and memory limits.

and then, try to restrict that index to that user..

https://community.splunk.com/t5/All-Apps-and-Add-ons/RBAC-with-indexes/td-p/401763?_ga=2.172840355.1690860399.1680137975-1734019103.1677135551&_gl=1*isnkm9*_ga*MTczNDAxOTEwMy4xNjc3MTM1NTUx*_ga_5EPM2P39FV*MTY4MDIyMTc4Mi4zNC4xLjE2ODAyMjM0MTEuNjAuMC4w#answer-759157

Re: Can a role only have write access to an index?

isoutamo — Fri, 31 Mar 2023 09:58:54 GMT

I don't think that this is possible.

How your role can collect that data to write into index if it cannot read it?

What is your actually issue which you are trying to solve.

r. Ismo

Re: Can a role only have write access to an index?

klim — Fri, 31 Mar 2023 17:12:04 GMT

If a role has access to index1, then it can search it and run something and then summary index via the collect command to index2. But I want it so that they can only write to index2 and can't read it.

Re: Can a role only have write access to an index?

isoutamo — Sat, 01 Apr 2023 13:07:16 GMT

I’m not sure, but maybe you could try search filter to restrict that read access? I’m not sure if it’s also block the write access too or not?

But you should remember that this role can always generate that data on summary index again from base indexes as long it was on those!