Lock Down REST api Role

lcr — Tue, 26 Nov 2019 16:51:02 GMT

We have an app that is using the OnTap REST api to create snapshots of specific volumes.

We would like to create a service account that ONLY has the rights to create snapshots on specified volumes.

Using the CLI we can create a "rest-role" that has all access to all volumes:

modify -vserver dc1-netsim -role SmartBackupRest -api /api/storage/volumes -access all

But when we try to lock this down to a specific operation:

create -vserver dc1-netsim -role SmartBackupRest -api /api/storage/volumes/snapshots -access all

we get "URI does not exist"

and if we try to use the actual URI called by the app (including the volume ID):

create -vserver dc1-netsim -role SmartBackupRest -api /api/storage/volumes/d9616397-a06b-4da4-931d-ee22f7bffeec/snapshots -access all

we get "Invalid character detected in URI."

How are we meant to lock the role down effectively?

Re: Lock Down REST api Role

klmi — Tue, 23 Feb 2021 11:41:38 GMT

we are having the same problem.
Did you get/found any solution for that until now?

Best Regards,

Klaus