Docs » Manage users and teams » About roles in Splunk Observability Cloud

About roles in Splunk Observability Cloud đź”—

Available in Enterprise Edition

Splunk Observability Clouds lets you restrict access to certain features to specific groups of users using role-based access control (RBAC). You assign roles to users. A role contains a set of capabilities. These capabilities define what actions are available to roles. For example, capabilities determine whether someone with a particular role has the capabilities to create detectors or dashboards. For details about each role and the associated capabilities, see Splunk Observability Cloud roles.

The new roles provide more restricted access. This supports scenarios where additional teams such as external vendors or teams that might belong to other business units, only need read-only access. Role-based access control lets you restrict users to the least-required capabilities, helping you meet compliance, business, or architectural requirements. By assigning the least required capabilities, you can help prevent users from making unwanted changes.

Additionally, Splunk Observability Cloud role-based access control aligns with roles available in Splunk Cloud Platform, providing a consistent user and capability-based experience across Splunk Cloud Platform and Splunk Observability CLoud.

Pre-defined roles

Splunk Observability Cloud comes with the following roles predefined:

Role

Description

admin

This role has the most capabilities assigned to it. An admin user has full privileges across Splunk Observability Cloud.

power

This role can access all components in Splunk Observability Cloud, access a subset of settings, and create, delete, and update charts, dashboards and detectors. This is the default role assigned to users.

usage

This role allows a user to view the subscription usage page without being an admin. This role also has read_only privileges.

read_only

This role can access all pages and objects that a power user can, but cannot create, edit, or delete objects. They have limited access to the Settings pages.

Splunk Observability Cloud tokens also honor the role-based access control framework. Since tokens can now be assigned to roles, APIs inherit capabilities from their token. For example, an API using a token which is created with read-only role will inherit read-only permissions. This can be used to take system backups with a reduced risk of introducing changes.

Tokens and API

  • Session token APIs inherit the user’s role capabilities.

  • Org tokens with API authorization scope can be assigned to predefined roles from the user interface.

  • RUM or INGEST tokens can’t be assigned a role.

APIs honor capabilities based on the role defined to their token. This is important to have strict role-based security control both from the front end and the backend.

  • APIs using Session Token - Session Tokens inherit individual user’s role capabilities.

  • APIs using Org Tokens - Similar to users and teams, even org tokens can be assigned a predefined role and inherit those capabilities. For example, if you are taking system backups on a regular basis, you can use read-only org token APIs to take those backups without worrying about accidental changes with APIs that have full capabilities.

Multiple roles for a user or team

You can assign multiple roles to individual users. The user receives a combination of capabilities inherited from all of their roles. Additionally, if you revoke a role from a user the change takes effect immediately.

Role

Capabilities

read-only

Read-only access to most actions and pages including settings for most products except the subscription usage pages, and some admin pages.

subscription usage

Access to subscription usage page only, plus the read-only capabilities.

power

Includes capabilities to access all components in Splunk Observability Cloud. Can access a subset of settings, and create, delete, and update charts, dashboards and detectors.

admin

An admin user has full privileges across Splunk Observability Cloud.

subscription usage and power user

All the capabilities of a power user, plus the ability to view the subscription usage pages for the org.

read_only and subscription usage

All the capabilities of a read-only user, plus the ability to view the subscription usage pages for the org.