All Apps and Add-ons

403 error integrating Splunk with GCP Pubsub

vik_splunk
Communicator

We are working on integrating splunk with GCP using the GCP-TA to ingest logs using the pubsub module.

We are encountering a 403 forbidden error as seen below. This is in the GCP pubsub log in the Splunk internal index.

"HTTPError: 403 Client Error: Forbidden for url: https://pubsub.googleapis.com/v1/projects//subscriptions/"

We've checked the permissions of the service account and the relevant role access and nothing is amiss within GCP.

The JSON key has been tested for authentication and it works as expected.

The pdf document that accompanies the TA is not very descriptive or explicit about the permissions that the account will require.

Any ideas or advise on the relevant permissions or steps to address this will be appreciated! Thanks!

1 Solution

vik_splunk
Communicator

We subsequently managed to resolve this issue by assigning elevated privileges to the GCP service account configured in Splunk.

View solution in original post

bennagengast
Engager

I did a little trial/error with this and I believe the permissions required by the service account are

pubsub.subscriptions.get
resourcemanager.projects.get

as well as a PubSub IAMBinding for roles/pubsub.subscriber for the topic you're intending to subscribe to.

vik_splunk
Communicator

We subsequently managed to resolve this issue by assigning elevated privileges to the GCP service account configured in Splunk.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...