Security

Azure Splunk Account

jwhughes58
Contributor

I've read through Ryan Lait's blogs "Splunking Microsoft Cloud Data" and it answers everything but what permissions does the account need on the Azure side. I keep finding this error in the MS Azure Blob log

2018-05-17 20:54:25,199 +0000 log_level=ERROR, pid=11729, tid=Thread-9, file=mscs_storage_dispatcher.py, func_name=_dispatch_storage_list, code_line_no=86 | [stanza_name="kp_azure_dev_blob" account_name="kpsactoaladevtest01" container_name="sqldbtdlogs" blob_list="kpsqmmsbmetastoreuscn01"] Exception@_dispatch_tables() ,error_message=This request is not authorized to perform this operation using this permission.

Since I don't control the Azure permissions, I need to know what permissions the account needs in order for the Azure team to give the correct permissions.

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

It sounds like you are using a shared access signature (SAS) for access based on your error message.

For allowed services, you will need:

  • Blob (based on your input)
  • Table (if you are using a table input)

For Allowed resource types, you will need:

  • Service, Container, and Object

For allowed permissions, you will need:

  • Read
  • List

Make sure the start and expire times are set accordingly and that your IP address is listed as allowed (if used).

alt text

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

It sounds like you are using a shared access signature (SAS) for access based on your error message.

For allowed services, you will need:

  • Blob (based on your input)
  • Table (if you are using a table input)

For Allowed resource types, you will need:

  • Service, Container, and Object

For allowed permissions, you will need:

  • Read
  • List

Make sure the start and expire times are set accordingly and that your IP address is listed as allowed (if used).

alt text

0 Karma

jwhughes58
Contributor

And as a side note the other problem was the Splunk TA lives on an internal network. Azure needs the NAT'ed IP in order to generate the correct SAS.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...