topic Re: Dedicated search head to give admin rights in Deployment Architecture

Can we add a dedicated search head to give admin rights?

splunkreal — Fri, 18 Feb 2022 16:35:58 GMT

Hello,

we have 3 SHC, could it be possible to add 1 SH dedicated to a special team and give admin rights only to this last one?

Thanks.

Re: Dedicated search head to give admin rights

gcusello — Fri, 18 Feb 2022 10:42:29 GMT

Hi @splunkreal,

if you have a Search Head Cluster you have the same rights in all the components.

if you have not clustered SHs, you can give different rigths to the configurated roles.

Anyway, you can give different grants to different groups (or roles).

Ciao.

Giuseppe

Re: Dedicated search head to give admin rights

PickleRick — Fri, 18 Feb 2022 10:45:14 GMT

You should simply install a separate SH using the same indexer(s).

Of course it would be managed completely separately from the SHC.

Re: Dedicated search head to give admin rights

splunkreal — Fri, 18 Feb 2022 11:19:19 GMT

Yes this looks good solution, thanks.

Re: Dedicated search head to give admin rights

splunkreal — Fri, 18 Feb 2022 12:45:16 GMT

Is it possible however this team adds then can_delete or delete_by_keyword capability and may be able to delete data on clustered indexers? Thanks.

Re: Dedicated search head to give admin rights

gcusello — Fri, 18 Feb 2022 12:51:29 GMT

Hi @splunkreal,

yes it's possibile but it isn't a good idea!

Ciao.

Giuseppe

Re: Dedicated search head to give admin rights

splunkreal — Fri, 18 Feb 2022 13:30:14 GMT

so that's the risk 😉

Re: Dedicated search head to give admin rights

isoutamo — Fri, 18 Feb 2022 16:21:58 GMT

That’s probably the biggest issue, as they had admin rights then they can do anything to all data what you have on your indexers. You cannot e.g. disable access to any indexes as they can add access to those as they want.

Re: Dedicated search head to give admin rights

PickleRick — Sat, 19 Feb 2022 09:19:07 GMT

Yes. Any permissions for actions called by users from SH are defined on that SH. You simply "pair" SH(C) with IDX(C) and the IDX has no concept of the end user, its identity and such. It's the SH that decides who can do what so if you give someone admin rights on SH, he can effectively do anything with your data.

Separating SH(C)'s makes sense for purposes of isolating search-time artifacts, KV-stores, managing saved searches and so on.