403-forbidden: insufficient permission(s) to perform this operation

Applicability

Description

The following error appears when calling Splunk Cloud to export app via ACS CLI's endpoint:

{"code":"403-forbidden","message":"insufficient permission(s) to perform this operation. Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips."}

The error indicates that user performing the task is missing necessary permission(s).

Investigation

1. Splunk Cloud Platform has to have the following version to export apps using the ACS API:

• 9.2.2403.133 and higher
• 9.2.2406.109 and higher
• 9.3.2408.103 and higher
• 9.3.2411 and higher

2. (Optional if already have one) Go to Settings > Users to create a test user with sc_admin role.

3. Go to Settings > Tokens to create a test token and associate it to the user to be used.

4. Go to Settings > Server Settings > IP Allow List Management > Search head API access to add public IP address of the source location.

5. Run the following command in terminal console:

curl -X GET 'https://admin.splunk.com/<stack>/adminconfig/v2/apps/victoria/export/download/<app_id>?local=true&default=false&users=true' --header 'Authorization: Bearer <TOKEN>' --output <File_Name>.tar.gz

6. A 403 forbidden error should show:

{"code":"403-forbidden","message":"insufficient permission(s) to perform this operation. Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips."}

Resolution

1. Per support doc, in addition to meeting the minimum Splunk version, possession of the export_apps role or a role with the export_apps capability is required. The sc_admin role is authorized to assign the export_apps role. By default, the export_apps capability is not included in sc_admin, but the export_apps role or capability can be directly assigned to sc_admin.

2. Go to Settings > Users and add export_apps role to the user that is associated with the token used in the ACS CLI.

3. In terminal console, run the command again:

curl -X GET 'https://admin.splunk.com/<stack>/adminconfig/v2/apps/victoria/export/download/<app_id>?local=true&default=false&users=true' --header 'Authorization: Bearer <TOKEN>' --output <File_Name>.tar.gz

4. Download should be allowed now:

Related Links