Using Admin Config Service (ACS) in Splunk Cloud Platform FedRAMP environments

Splunk Cloud Platform prerequisites and token creation

1. Ensure that you, or the user listing and editing the allow list, have access to the necessary capabilities within their Splunk role. Note that the sc_admin role has this capability by default. You’ll need to ensure that the "acs_list_ip_allow_list" capability is enabled in order to list the environment IPs, and that the  "edit_ip_allow_list" is enabled in order to update the allow list. A full matrix of capabilities needed for the ACS API is available at Splunk Docs. 
2. Generate a JWT token to authenticate to the API. You can create these tokens through Splunk Web.
   1. In Splunk Web, click Settings > Token > Enable Token Authentication > New Token.
   2. Configure the new token using the guidance in Splunk Docs.
   3. Copy/paste and save your token to a secure location such as a password manager. It will not be available again after closing this screen.

Configure the ACS CLI to access your stack and use the new token

1. Set an environment variable with your authentication token. In this example we're setting the token value through the command line. This has security implications, but it might be appropriate for smaller or test deployments, depending on your needs.

   (Windows) >set STACK_TOKEN=eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnIjoiSFM1MTI...
   (Linux)   >export STACK_TOKEN=eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnIjoiSFM1MTI…
   

2. Set an environment variable for the FedRAMP Moderate specific API endpoint. It’s also possible to use the --server flag for each command to override the commercial ACS endpoint (example: acs apps list --server https://admin.splunkcloudgc.com/).

   (Windows) >set ACS_SERVER=https://admin.splunkcloudgc.com/
   (Linux)   >export ACS_SERVER=https://admin.splunkcloudgc.com/
   

3. Configure ACS to use the desired Splunk Cloud Platform environment. Replace <mysplunkcloudstack> with your stack name. You can find your stack name within your domain name, e.g. https://mysplunkcloudstack.splunkcloud.com. After you've completed this step, ACS will be configured to authenticate to your Splunk Cloud Platform stack.

   >acs setup <mysplunkcloudstack>
   Stack added: cloud-architects, Type: victoria
   current-stack is now set to <mysplunkcloudstack>
   Token successfully cached to authenticate against ACS for further operations
   Populating stack type...
   

Working with the ACS CLI

1. Use the built-in help command >acs ip-allowlist --help to identify the syntax necessary to audit the IP allow list.

   >acs ip-allowlist --help
   The IP allow list controls access to a particular Splunk Cloud Platform feature. When you run further operations, you must specify the <feature> argument, such as search-api, hec, s2s, and so on.
   Note that the value of <feature> refers to a logical grouping of subnets that are granted access to a Splunk component.
   The ACS API supports the following IP allow list use cases:
   +--------------------------+------------+--------+-------------------------------------------------------------------------------------------------------+
   | Use Case                 | Feature    | Port   | Description                                                                                           |
   +--------------------------+------------+--------+-------------------------------------------------------------------------------------------------------+
   | Search head API access   | search-api | 8089   | Grants access for customer subnets to Splunk search head api (applies to automated interfaces)        |
   +--------------------------+------------+--------+-------------------------------------------------------------------------------------------------------+
   | HEC access for ingestion | hec        | 443    | Allows customer's environment to send HTTP data to Splunk indexers.                                   |
   +--------------------------+------------+--------+-------------------------------------------------------------------------------------------------------+
   | Indexer ingestion        | s2s        | 9997   | Allows subnets that include UF or HF to send data to Splunk indexers.                                 |
   +--------------------------+------------+--------+-------------------------------------------------------------------------------------------------------+
   | SH UI access             | search-ui  | 80/443 | Grant explicit access to search head UI in regulated customer environments.                           |
   +--------------------------+------------+--------+-------------------------------------------------------------------------------------------------------+
   | IDM UI access            | idm-ui     | 443    | Grant explicit access to IDM UI in regulated customer environments.                                   |
   +--------------------------+------------+--------+-------------------------------------------------------------------------------------------------------+
   | IDM API                  | idm-api    | 8089   | Grant access for add-ons that require an API. (Allows add-ons to send data to Splunk Cloud Platform.) |
   +--------------------------+------------+--------+-------------------------------------------------------------------------------------------------------+
   

2. To remove and add an IP from the IP allow list, use the describe command to review the allow list for the "search-ui" feature. The output is a json array of subnets.  

   >acs ip-allowlist describe search-ui
   {
       "subnets": [
           "1.2.2.2/32",
           "1.2.3.4/32"
       ]
   }
   

3. In this example, the 1.2.3.4/32 subnet should have been 1.2.3.5/32 and not 1.2.3.4/32 as being returned by ACS. To correct this, you’ll need to remove the 1.2.3.4/32 subnet and add the 1.2.3.5/32 subnet. Remove the 1.2.3.4/32 subnet using the following command.

   >acs ip-allowlist delete search-api --subnets 1.2.3.4/32
   IP allow list subnets deleted successfully.
   To verify the status of your stack after subnet delete request, please run the "acs status current-stack" command.
   {
       "warnings": [
           "IP allow list subnets creation request submitted successfully. Note that it can take several minutes for the subnet update to be applied to your Splunk Cloud Platform stack."
       ]
   }
   

4. Confirm the subnet was removed with the describe command used previously.

   >acs ip-allowlist describe search-api
   {
       "subnets": [
           "1.2.2.2/32"
       ]
   }
   

5. Add the 1.2.3.5/32 address to complete the update.

   acs ip-allowlist create search-api --subnets 1.2.3.5/32
   IP allow list subnets creation request submitted successfully for feature:search-api
   Note that it can take several minutes for the subnet update to be applied to your Splunk Cloud Platform stack.
   To verify the status of your stack after subnet update request, please run the "acs status current-stack" command.
   {
       "warnings": [
           "IP allow list subnets creation request submitted successfully. Note that it can take several minutes for the subnet update to be applied to your Splunk Cloud Platform stack."
       ]
   }
   

6. Finally, verify the subnet has been added.

   >acs ip-allowlist describe search-api
   {
       "subnets": [
           "1.2.2.2/32",
           "1.2.3.5/32"
       ]
   }
   

Next steps 

These resources might help you understand and implement this guidance:

• Splunk Docs: Admin Config Service manual
• Tech Talk: Start managing your deployment with Splunk Cloud’s Admin Configuration Service (ACS)