Security

Azure Splunk Account

jwhughes58
Contributor

I've read through Ryan Lait's blogs "Splunking Microsoft Cloud Data" and it answers everything but what permissions does the account need on the Azure side. I keep finding this error in the MS Azure Blob log

2018-05-17 20:54:25,199 +0000 log_level=ERROR, pid=11729, tid=Thread-9, file=mscs_storage_dispatcher.py, func_name=_dispatch_storage_list, code_line_no=86 | [stanza_name="kp_azure_dev_blob" account_name="kpsactoaladevtest01" container_name="sqldbtdlogs" blob_list="kpsqmmsbmetastoreuscn01"] Exception@_dispatch_tables() ,error_message=This request is not authorized to perform this operation using this permission.

Since I don't control the Azure permissions, I need to know what permissions the account needs in order for the Azure team to give the correct permissions.

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

It sounds like you are using a shared access signature (SAS) for access based on your error message.

For allowed services, you will need:

  • Blob (based on your input)
  • Table (if you are using a table input)

For Allowed resource types, you will need:

  • Service, Container, and Object

For allowed permissions, you will need:

  • Read
  • List

Make sure the start and expire times are set accordingly and that your IP address is listed as allowed (if used).

alt text

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

It sounds like you are using a shared access signature (SAS) for access based on your error message.

For allowed services, you will need:

  • Blob (based on your input)
  • Table (if you are using a table input)

For Allowed resource types, you will need:

  • Service, Container, and Object

For allowed permissions, you will need:

  • Read
  • List

Make sure the start and expire times are set accordingly and that your IP address is listed as allowed (if used).

alt text

0 Karma

jwhughes58
Contributor

And as a side note the other problem was the Splunk TA lives on an internal network. Azure needs the NAT'ed IP in order to generate the correct SAS.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...