Skip to main content

IAM for Logs Data Platform - Presentation and FAQ

Stephanie R.
Updated

Learn about the integration of Logs Data Platform with OVHcloud IAM.

IAM for Logs Data Platform will be available starting September 17, 2025. The content of this documentation will be valid from this date.

 

Requirements

 

Instructions

How is IAM useful for Logs Data Platform?

Enabling OVHcloud IAM on Logs Data Platform delegates authentication, access management, and permissions to OVHcloud IAM. There are several benefits to using IAM:

  • All OVHcloud identities can connect using their credentials to all Web UIs (i.e., Graylog, OpenSearch Dashboards). The connected account will be the identity chosen for UI access. You will no longer need the Logs Data Platform username. IAM also enables the use of two-factor authentication methods and Federation Services.
  • API tokens can be both service account tokens and Personal Access Tokens handled directly with OVHcloud IAM APIs.
  • Resource groups allow you to share Logs Data Platform sub-resources more cohesively.
  • IAM Policies unlock advanced use cases that are not possible with permissions, thanks to fine-grained actions.

iam identities

 

How to enable OVHcloud IAM for my existing account in Logs Data Platform?

If you have an existing service, follow these steps:

  • Replace all your Roles and permissions with appropriate policies.
  • Ensure you have no Roles declared in your service.
  • Ensure your service is not in any Roles.
  • Ensure you don't have any tokens.
  • Use the Enable OVHcloud IAM button in the Roles tab of the Logs Data Platform Control Panel.

LDP_rolesTab.png

Once IAM is activated, a new IAM Policies tab will replace the previous Roles tab.

LDP_IAMpoliciesTab.png

 

How to enable OVHcloud IAM on a new service?

When a new service is created, you can directly opt into using IAM and use IAM policies to handle access rights.

LDP_newService_enableIAM.png

Once IAM has been activated, you can freely use any OVHcloud identities to interact with Logs Data Platform.

 

How to connect to Graylog with IAM?

When connecting to Graylog, you can choose between the legacy username/password system (for services without IAM activated) or the OVHcloud IAM US provider. Clicking the Log in with OVHcloud IAM US button redirects you to complete authentication.

NOTE: Only the US provider is supported.

graylog_loginIAM.png

graylog_login.png

 

How to connect to OpenSearch Dashboards with IAM?

When connecting to OpenSearch Dashboards, select the provider linked to your OVHcloud service. The Log in with single sign-on button redirects you to your provider to complete authentication.

opensearch_loginIAM.png

Once completed, you will be redirected back to the OpenSearch Dashboard instance fully authenticated.

 

How to interact with Logs Data Platform backends API?

With IAM enabled, tokens are replaced by API keys (Bearer authentication scheme). These keys can be tokens from service accounts or Personal Access Tokens. Use the OVHcloud API to generate these tokens.

POST /me/identity/user/{user}/token

For example, if you are on bhs2 cluster, curl can use these tokens in the following way:

ldp@laptop curl -k -v -H 'content-type: application/json' --oauth2-bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c  -XGET 'https://bhs2.logs.ovh.com:9200/_cluster/health?pretty'

 

How to create indices or aliases on Logs Data Platform backend APIs?

First, ensure the identity you want to use has permission to create indices and aliases for the service. If authorized, Personal Access Tokens or service account OAuth2 clients can perform creation/deletion operations.

NOTE: The previous prefix for indices and aliases was the username. Now the prefix is the service name. You will find the service name on the homepage of the Logs Data Platform control panel. It is also the suffix of a Logs Data Platform service URN. For example:

urn:v1:us:resource:ldp:ldp-ab-56945

The service is tied to a unique Logs Data Platform, so you will be allowed to create items only on this cluster. For example if ldp-ab-56945 is on bhs2:

ldp@laptop curl -k -v -H 'content-type: application/json' --oauth2-bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c  -XPOST 'https://bhs2.logs.ovh.com:9200/ldp-ab-56945-i-my-new-index/_doc' -d '{ "user" : "ldp" }'

Similarly, aliases created through OpenSearch APIs must be prefixed by one of your allowed services.

 

Go further

Related articles