Missing o11y roles in Splunk Cloud Platform

Applicability

Description

When integrating Splunk Observability Cloud with Splunk Cloud Platform via Unified Identity, only the o11y_access role may be visible in the Splunk Cloud management console. This limitation prevents administrators from assigning granular permissions, such as Admin or Power User, to users directly from the Splunk Cloud Roles page. All users assigned only the o11y_access role are typically mapped to a default role (often Power User) within the Observability Cloud environment, rather than the intended specific permission level.

Investigation

To determine if the environment is missing the necessary prepackaged roles, follow these steps:

1. Log in to the Splunk Cloud Platform instance.

2. Navigate to Settings > Users and Authentication > Roles.

3. Use the filter or search bar to search for the string: o11y

4. Review the results.

5. If only the o11y_access role is listed and the following roles are missing, the observability capabilities have not yet been enabled for the stack:

• o11y_admin

• o11y_power

• o11y_read_only

• o11y_usage

6. Verify the current configuration of the role stanzas. While these are managed by the cloud provider, the expected configuration targets the following path: $SPLUNK_HOME/etc/system/local/authorize.conf

Resolution

To make the Observability Cloud roles available in Splunk Cloud Platform, the observability capabilities must be enabled through the Admin Config Services (ACS) API.

Prerequisites:

• The Splunk Cloud Platform instance must be connected to a Splunk Observability Cloud organization.

• The user must have a token with the necessary permissions to run ACS commands.

Step-by-Step Instructions:

1. Access the command line interface where the ACS CLI is installed.

2. Confirm that your organization has set up Unified Identity. If not, run the following Admin Config Services (ACS) command to set up Unified Identity:

   acs observability pair --o11y-access-token "<enter-o11y-access-token>" 

   Replace <enter-o11y-access-token> in the example above, with the user API access token you retrieved from Splunk Observability Cloud in previous step.

3. Run the following command to enable the observability roles and capabilities for the stack:

acs observability enable-capabilities

3. Wait approximately 30 minutes for the roles to propagate through the environment.

4. Log back into the Splunk Cloud Platform instance and navigate to Settings > Users and Authentication > Roles to verify the roles now appear.

Related Links

How to set up centralized user and role management