Right now it looks like Splunk only allows 2 methods to access an Azure Storage account (ASA) \ logs$ container; namely, generating a SAS or providing the an actual shared key. Our preference would be RBAC with a service principle. Does Splunk support this method?
• Generating a SAS, although granular, makes key management a nightmare. Every time ASA keys are regenerating, the SAS become invalid.
• Using ASA keys is not preferred due to the admin level of rights this would give Splunk.
• App/SP with RBAC is less granular, but easy to manage.
Is there any other methodology Splunk support might recommend? Or a different way keys might be managed?
+1 on this one. Tried to work around it by using a user delegation token on the $logs container, but sadly the Web UI checks access in a way that causes issues right here (why does it even have to do that!?). Maybe it would work if one pasted the token into the config files directly? I sadly can't try it as I don't have access to the server myself...