topic Re: ActiveIQ Unified Manager Least Privilege Account in ONTAP Discussions

ActiveIQ Unified Manager Least Privilege Account

TMADOCTHOMAS — Thu, 18 Feb 2021 20:17:30 GMT

ActiveIQ Unified Manager documentation says the following about the local account used for discovery:

------------------------------------

This account must have the admin role with Application access set to ontapi, ssh, and http.

------------------------------------

My question: is this really accurate? I don't see why it requires the admin role since AIUM is just reading data to populate charts and tables. Anyone have insight here? We are trying to reduce service accounts to the least amount of permissions needed and I'm thinking this is a good candidate for reduction, but documentation says otherwise.

Re: ActiveIQ Unified Manager Least Privilege Account

Mjizzini — Tue, 23 Feb 2021 08:15:33 GMT

This account must have the admin role with Application access set to ontapi, ssh, and http

Unable to add cluster to Active IQ Unified Mana

Re: ActiveIQ Unified Manager Least Privilege Account

TMADOCTHOMAS — Tue, 23 Feb 2021 14:04:46 GMT

Okay thank you @Mjizzini. Are there any recommendations to securing this account since it has to have these rights?

Re: ActiveIQ Unified Manager Least Privilege Account

liu — Mon, 23 Dec 2024 08:51:35 GMT

It is convenient for you to obtain the health of the cluster, capacity performance, so that you can find and solve problems in time

What permissions are required to add a cluster to AIQUM? - NetApp Knowledge Base