Splunk Dev

secret storage for API key

marathon-man
Observer

I'm running into a limitation with Splunk custom apps where I want the admin to be able to set some API key for my 3rd party app and I want everyone to have access to this secret in order to actually run the custom commands that call the 3rd party API, without the admin having to give out list_storage_passwords for everyone if possible.

Is there any workaround to this or are we still limited to the workarounds described below? E.g. having to give list_storage_passwords to everyone and then retroactively apply fine-grained access controls to every secret. How are devs accomplishing this?

https://community.splunk.com/t5/Splunk-Dev/What-are-secret-storage-permissions-requirements/m-p/6414...

---

This idea is 3.5 years old at this point.

https://ideas.splunk.com/ideas/EID-I-368

 

Labels (1)
0 Karma

mattymo
Splunk Employee
Splunk Employee

Last I checked it is still the case that all apps have access to the secret store and have to use controls to limit access. 

Came up when working with 1Password on their app. Will poke around and see if any hardening or rework is in the cards this year....

Dev docs have seem to have been

updated. https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragerbac/#...

If still think more is needed, hit the feedback link on this doc. dev team has heard this before. glad they have added the docs, but if still need more, good place to start. 

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...