secret storage for API key

[marathon-man]

I'm running into a limitation with Splunk custom apps where I want the admin to be able to set some API key for my 3rd party app and I want everyone to have access to this secret in order to actually run the custom commands that call the 3rd party API, without the admin having to give out list_storage_passwords for everyone if possible.

Is there any workaround to this or are we still limited to the workarounds described below? E.g. having to give list_storage_passwords to everyone and then retroactively apply fine-grained access controls to every secret. How are devs accomplishing this?

https://community.splunk.com/t5/Splunk-Dev/What-are-secret-storage-permissions-requirements/m-p/6414...

---

This idea is 3.5 years old at this point.

https://ideas.splunk.com/ideas/EID-I-368

[mattymo]

Last I checked it is still the case that all apps have access to the secret store and have to use controls to limit access. 

Came up when working with 1Password on their app. Will poke around and see if any hardening or rework is in the cards this year....

Dev docs have seem to have been

updated. https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragerbac/#...

If still think more is needed, hit the feedback link on this doc. dev team has heard this before. glad they have added the docs, but if still need more, good place to start.