For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt, and this page is available as Markdown at https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/iam-access-management.md.
  • English

IAM for Logs Data Platform - Configuring access rights

View as Markdown

Learn how to configure access rights on OVHcloud IAM to manage permissions for various components of Logs Data Platform.

This guide will give you the best practices to handle the rights given to your users and will ensure that you can replicate the functionality of roles and permissions with the more advanced system of policies. This guide will use the features explained in our IAM documentation. It is therefore recommended to read it before reading this guide.

 

Requirements

 

Policies and identities

This guide leverages local users to explain how you can share resources with another user. The policies created can be applied to any OVHcloud identities through the OVHcloud API. You can use these policies to share data with a local user, another OVHcloud user account, or an OAuth client. You can refer to the specific IAM Policies section of the API guide to recreate all these policies with the API.

The identity will see a new service listed in their Logs Data Platform. This service contains the shared Logs Data Platform items. To ensure the recipient can see the shared items, we must share a view of the service with them.

 

Access Rights Management

This section details how to configure local user/identity groups and policies to replicate the behavior of the legacy role system.

 

Create a group for local users

By default, the least privileged group available for local users is read-only over all the products of your account. If you would like to have an even more restricted account able to read only shared data from your Logs Data Platform, we advise you to create a group with the role None and attach your local users to it. In the OVHcloud Control Panel, navigate to Identity, Security & Operations > Identities > User groups > Declare a group.

IAM user groups tab declare group no read rights

You can then create a policy with the basic rights to access the OVHcloud Control Panel and attach it to the group. All your local users will be able to connect to the OVHcloud Control Panel. Navigate to Identity, Security & Operations > Policies > Create a policy to create this policy and attach it to the user group.

IAM policies create policy no read rights - step 1

After attaching the group, follow the instructions in our Creating an IAM policy to allow users access to the OVHcloud Control Panel guide.

Once the group is configured, you can then create the local users.

 

Create a local user

Creating a local user is fully documented in the dedicated documentation. Remember to attach the user to the group.

IAM add user LDP read only

 

Create a policy for the service

You now need to create a policy to allow the local user to see the Logs Data Platform service inside the OVHcloud Control Panel. The goal here is to have access to the service only, but without any sub-resources visible (i.e., no streams, dashboards, indices, aliases, or OpenSearch Dashboards instances). Navigate to Identity, Security & Operations > Policies > Create a policy.

  1. Policy name: (i.e., share_service_only)

  2. Local users: the user you created in the previous step (i.e., ldp)

    IAM policy share service only - step 1

  3. Product types: Logs Data Platform: Service

  4. Resources: your Logs Data Platform service(s) (i.e., ldp-xx-00000)

    IAM policy share service only - step 2

  5. The policy can then allow the service with read-only access to the chosen service. Some mandatory actions need to be given for users to be able to see the Logs Data Platform control panel without error. The minimal set of actions is listed below:

    - ldp:apiovh:cluster/get
- ldp:apiovh:cluster/retention/get
- ldp:apiovh:encryptionKey/get
- ldp:apiovh:get
- ldp:apiovh:input/get
- ldp:apiovh:metrics/get
- ldp:apiovh:role/get
- ldp:apiovh:serviceInfos/get
- ldp:apiovh:token/get
- ldp:apiovh:url/get

    IAM policy share service only - step 3

Click Create policy once you've added the required actions.

Once the policy is attached to the identity, the users will see the new service in their control panel, but with no items available.

 

Create a sub-resources group

All the items created by a Logs Data Platform (i.e., streams, dashboards, etc.) are materialized as sub-resources of the LDP service. One of the new features available thanks to IAM is the ability to group sub-resources in a Resource group. A Resource group can be used to share related resources and is a convenient way to group items that are supposed to be used together. For example: a stream and its related dashboard, an alias and an OpenSearch Dashboard to explore it, and an alias with all the streams attached to it. This feature is a good way to completely isolate sub-resources and make sure you don't have to handle them one by one over all your policies.

To create a resource group, navigate to Identity, Security & Operations > Policies > Resource groups > Create a resource group.

You need to select the product type (Dashboards, Streams, Alias, Index, OpenSearch Dashboards) and then select the specific resource you want to share.

Create resource group

 

Create a policy for the sub-resources

This policy is the one you need to effectively replicate the legacy roles' permissions. You will attach OVHcloud APIs rights and backend (Graylog, OpenSearch) rights to allow identities to see the items in their shared service and interact with them in the corresponding Web UIs and APIs. Again, navigate to Identity, Security & Operations > Policies > My Policies > Create a policy.

Similar to the previous policy, you need to add your local user, and you need to select the product type of your resource or sub-resource if you want to enable the actions selection panel for these specific sub-resources.

Subresource policy - IAM access management

Warning

NOTE: Do not add a Logs Data Platform service to this policy. If you do so, it will transitively give access to all sub-resources of this service (i.e., all LDP items) to the local users/identities or groups attached to the policy. The previous service policy has been created to prevent this behavior.

You can mix Resource Groups and specific resources in the same policy. All actions attached to the policy will then be attached to all related sub-resources.
You have several actions for each sub-resource type. For brevity, this guide will not detail all the actions available for all the items.

Here are some use cases of several rights that can all be together in one policy, showcasing the complexity enabled by IAM policies. Actions starting with ldp:apiovh are actions related to OVHcloud APIs (thus the control panel UI). The other actions are related to their specific backend: Graylog or OpenSearch.

Click the menus below to display the related examples:

These actions give an access in read-only to one or several indices:
- ldp:apiovh:output/opensearch/index/get
- ldp:apiovh:output/opensearch/index/url/get
- ldp:opensearch:index/read

Index actions - IAM access management

These actions allow reading and modifying a Graylog Dashboard:
- ldp:graylog:dashboard/update
- ldp:apiovh:output/graylog/dashboard/get
- ldp:apiovh:output/graylog/dashboard/url/get
- ldp:graylog:dashboard/read

Dashboards actions - IAM access management

These actions allow you to consult and create visualizations in one or several OpenSearch Dashboard instances:
- ldp:opensearch:osd/update 
- ldp:apiovh:output/opensearch/osd/get
- ldp:apiovh:output/opensearch/osd/url/get
- ldp:opensearch:osd/get

Open search dashboards actions

These actions give read-only access in both Graylog and the control panel to one or several streams:
- ldp:apiovh:output/graylog/stream/get
- ldp:apiovh:output/graylog/stream/url/get 
- ldp:graylog:stream/read

Data stream actions

Once the policy is created, the local user/identity will only see the related sub-resource of the policy in its own control panel.

Sub user data stream view

 

Go further with local users

Local users are useful for generating Personal Access Tokens (PATs). These tokens have a configurable expiration date and can be used to interact with both the OVHcloud APIs and the Logs Data Platform backends.

POST/me/identity/user/{user}/token

Thanks to OVHcloud IAM, you can then delegate the creation rights of sub-resources (indices, aliases) to your local user and interact with the backend APIs directly with these Personal Access Tokens.

The actions related to creating items are part of the service actions. You will need to add them to a policy to allow a user to create items with their PAT.

Info

You don't need to allow any OVHcloud APIs action to allow a local user to interact with the Logs Data Platform backends (OpenSearch, Graylog, OpenSearch Dashboards) APIs. Local users allow you to generate tokens that can only interact with the backend, similarly to legacy Logs Data Platform tokens.

For example, these two rights allow a local user to create indices/aliases directly on OpenSearch without having any other rights on the OVHcloud APIs.

Policy create alias index

 

Go further

Browse all the Logs Data Platform guides.

Browse the rest of the OVHcloud US documentation for guides on our other products and services.

Learn more about Logs Data Platform on the OVHcloud US website.