Right now it looks like Splunk only allows 2 methods to access an Azure Storage account (ASA) \ logs$ container; namely, generating a SAS or providing the an actual shared key. Our preference would be RBAC with a service principle. Does Splunk support this method?
• Generating a SAS, although granular, makes key management a nightmare. Every time ASA keys are regenerating, the SAS become invalid.
• Using ASA keys is not preferred due to the admin level of rights this would give Splunk.
• App/SP with RBAC is less granular, but easy to manage.
Is there any other methodology Splunk support might recommend? Or a different way keys might be managed?
