Manage IAM keys

Imply Lumi uses unique identifiers called Identity and Access Management (IAM) keys to handle authentication and authorization from external systems. You need an IAM key to authorize applications to add and search events in Imply Lumi.

This topic provides details on creating and managing IAM keys within the Imply Lumi UI. For reference on IAM key attributes and applications, see IAM keys.

Prerequisites

To create and manage IAM keys, you need access to Imply Lumi with the Manager or higher role. For more information on roles, see Manage roles.

Create an IAM key

info

Imply Lumi doesn't support creating IAM keys for administrative purposes.

To create an IAM key:

1. Click Keys from the navigation menu.
2. Click + Create key.
3. Enter IAM key details:
   • Name: Name of the IAM key.
   • Description (optional): Description for the IAM key.
   • Attributes: Attributes that enrich events sent to Imply Lumi using this IAM key. Their relevance depends on how you use the IAM key:
     • Send events with the HTTP event collector (HEC): Global and HEC attributes.
     • Send events with S3 ingest actions: Only global attributes.
     • Send events with Splunk® TCP: Global and S2S attributes.
     • Federated search: No attributes.
       For more information, see Attributes on an IAM key.
4. Click Create.

You can also create an IAM key while configuring event forwarding on the Integrations page. In Select or create an IAM key, expand the IAM key menu and click Create.

View an IAM key

The Keys page displays the IAM keys you have access to. To view information for a specific IAM key, click the name of the key.

Update an IAM key

You can update the name, description, and attributes of an IAM key. The changes you make to the IAM key or its properties can affect the key's ability to add, query, and enrich events.

To update an IAM key:

1. Click Keys from the navigation menu.
2. Click the IAM key you want to update.
3. Edit the key's properties as desired and click Update.

Delete an IAM key

Deleting an IAM key is a permanent action. It affects all integrations relying on that IAM key for authentication. We recommend that before you delete an IAM key, you update any related integrations with a new IAM key first. This allows the integration to function without interruption.

To delete an IAM key:

1. Click Keys from the navigation menu.
2. Click the IAM key you want to delete.
3. Click Delete.
4. When prompted, type the name of the IAM key you want to delete; then click Delete.

View IAM keys by integration

You can view keys that have been configured or used for a specific integration. Click Integrations in the navigation menu and select an integration to view all of its associated keys.

A key is considered active if it has been used to add or search events in the past 24 hours.

For each IAM key, a bar chart shows activity over the past 24 hours. Hover over a bar to see the number of events added or searched during that hour.

Click the ellipsis next to the key to access additional menu options. From this menu, you can:

• Select a key to configure the integration.
• Search events associated with that integration and key.
• View the IAM key ID, token, and attributes stored on the key.

Learn more

For reference on IAM keys, see IAM keys.