Give your users role-based access control of federated indexes

After you create an Amazon S3 federated index, you must give your federated search users role-based access control of the index. If you do not do this, your users cannot search the remote AWS Glue table dataset that the federated index maps to.

As with normal Splunk platform indexes, you grant access to federated indexes at the role level. With role-level federated index grants, you can grant federated index access to certain groups of users while disallowing access to other user groups.

On your local deployment, you must define additional role-based access control rules that identify the federated indexes to which your users have access. Each federated index on your local deployment maps to a single dataset on a standard mode federated provider, so this practice ensures that specific roles have access only to specific remote datasets.

Prerequisites

• You must have the sc_admin role.
• You must have an Amazon S3 federated index.

Steps

After you create an Amazon S3 federated index, follow these steps to give your federated search users access to the index.

1. On your Splunk Cloud Platform deployment, in Splunk Web, select Settings and then select Roles.
2. Select the name of a role that you have given to users who run federated searches.
3. Select Indexes to display the contents of the Indexes tab.
4. Locate the federated indexes you have defined. All federated index names in the Indexes list begin with federated:.
5. Select Included for a federated index to allow users with this role to see search results from that index.

   If Included is not selected for any Amazon S3 federated indexes, users with this role cannot run federated searches over Amazon S3 data.

6. To save all of the changes you have made and close the dialog box, select Save.

See Create and manage roles with Splunk Web in the Securing the Splunk Cloud Platform manual.