I've read through Ryan Lait's blogs "Splunking Microsoft Cloud Data" and it answers everything but what permissions does the account need on the Azure side. I keep finding this error in the MS Azure Blob log
2018-05-17 20:54:25,199 +0000 log_level=ERROR, pid=11729, tid=Thread-9, file=mscs_storage_dispatcher.py, func_name=_dispatch_storage_list, code_line_no=86 | [stanza_name="kp_azure_dev_blob" account_name="kpsactoaladevtest01" container_name="sqldbtdlogs" blob_list="kpsqmmsbmetastoreuscn01"] Exception@_dispatch_tables() ,error_message=This request is not authorized to perform this operation using this permission.
Since I don't control the Azure permissions, I need to know what permissions the account needs in order for the Azure team to give the correct permissions.
It sounds like you are using a shared access signature (SAS) for access based on your error message.
For allowed services, you will need:
For Allowed resource types, you will need:
For allowed permissions, you will need:
Make sure the start and expire times are set accordingly and that your IP address is listed as allowed (if used).
It sounds like you are using a shared access signature (SAS) for access based on your error message.
For allowed services, you will need:
For Allowed resource types, you will need:
For allowed permissions, you will need:
Make sure the start and expire times are set accordingly and that your IP address is listed as allowed (if used).
And as a side note the other problem was the Splunk TA lives on an internal network. Azure needs the NAT'ed IP in order to generate the correct SAS.