All Apps and Add-ons

Azure Storage Account Authentication

rfolkert
Engager

Right now it looks like Splunk only allows 2 methods to access an Azure Storage account (ASA) \ logs$ container; namely, generating a SAS or providing the an actual shared key. Our preference would be RBAC with a service principle. Does Splunk support this method?
• Generating a SAS, although granular, makes key management a nightmare. Every time ASA keys are regenerating, the SAS become invalid.
• Using ASA keys is not preferred due to the admin level of rights this would give Splunk.
• App/SP with RBAC is less granular, but easy to manage.

Is there any other methodology Splunk support might recommend? Or a different way keys might be managed?

mgoerlich
Engager

+1 on this one. Tried to work around it by using a user delegation token on the $logs container, but sadly the Web UI checks access in a way that causes issues right here (why does it even have to do that!?). Maybe it would work if one pasted the token into the config files directly? I sadly can't try it as I don't have access to the server myself...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...