Skip to main content

Manage IAM keys

AI summary
Explains how to use IAM keys to authenticate external systems with Imply Lumi for event operations. Use the Manager role to create keys and add integrations to them. You can reuse keys across integrations and manage them through the Keys page.

About AI summaries.

In Imply Lumi, an IAM key provides the central point of access for sending and searching events. This topic guides you through creating and managing IAM keys.

Prerequisites​

To create and manage IAM keys, you need access to Lumi with the Manager or higher role. For more information on roles, see Manage roles.

Create an IAM key​

You can create an IAM key from the Keys page or while configuring an integration on the Integrations page. Select a tab to view instructions for that approach.

To create an IAM key from the Keys page:

  1. From the Lumi navigation menu, click Keys.
  2. Click + Create key.
  3. Enter IAM key details:
    • Name: Name of the IAM key.
    • Description: Optional description for the IAM key.
    • Global attributes: Optional values for the environment and team.
      These create system attributes on incoming events when you use an ingestion integration.
  4. Click Create. The key is inactive until you add an integration.
  5. Click + Add integration, and select an integration to use with the key. Add integration
  6. Configure any IAM key attributes supported by the integration.
  7. Click Save.

After you create an IAM key, you can create an IP allowlist to secure the IAM key against unpermitted use. For more information, see IP allowlist.

View an IAM key​

Access the Keys page from the Lumi navigation menu to view IAM keys.

View all keys​

The Keys page shows the following details for an IAM key:

  • Key name and ID
  • Integrations added to the key
  • When the key was created and last active
  • Ingestion metrics for events with timestamps from the past 24 hours
  • Unparsable events, if any occurred

Click the information icon next to a key to view its description and token. You can use the search bar to filter keys by name, integration type, or IAM key ID.

View IAM keys

View key details and metrics​

Select an IAM key to view its details. The Integrations pane shows activity from the IAM key for each receiver. Hover over a bar to see usage during that hour. The metrics shown depends on the integration type:

  • For application integrations, a green bar indicates the number of searches run in that hour.
  • For ingestion integrations, the color of the bar indicates the event status, where green sums the number of successful events and yellow sums the number of unparsable events.

View IAM key details

Update an IAM key​

info

The changes you make to the IAM key or its properties can affect your access to add and query events.

To update an IAM key:

  1. From the Lumi navigation menu, click Keys and select your key.
  2. Make the desired changes:
    • To update the global attributes, click the edit icon in Global attributes.
    • To update the IP allowlist, click the edit icon in IP allowlist. For more information about IP allowlists, see IP allowlist.
    • To update the description, click the edit icon in Description.
    • To add a new integration, click Add integration and make your selection.
    • To remove an integration, click the ellipsis for the integration, then select Remove.
    • To update the attributes for an integration, click the ellipsis for the integration, then select Edit attributes.

Edit IAM key details

IP allowlist​

info

This feature is available for Lumi Cloud by default. For Lumi Enterprise, contact your Imply support representative.

You can create an IP allowlist for an IAM key after you create the key. The allowlist restricts which IP addresses and CIDR ranges can use that specific key. For example, if you add the IP 198.51.100.89 to the allowlist for an IAM key with the Splunk HEC integration, traffic to Lumi through the integration must originate from that IP or else the ingestion fails. By default, the IP allowlist is turned off and there are no restrictions on what networks you can use with an IAM key and its integrations.

The IP allowlist supports the following integrations: OTLP, Splunk HEC, S2S, S3 ingest actions, MCP, and SPL queries. For Splunk-related integrations, make sure you use the Splunk egress IP since traffic to Lumi originates from there.

IP allowlist restrictions don't apply to the S3 pull integration, including incoming SNS notifications. Lumi initiates S3 pull integrations, so there's no inbound client IP to enforce. SNS source addresses are part of AWS's public shared IP ranges, so they aren't meaningful to enforce against.

Prerequisites​

To create or edit an allowlist, you must have either AdministerIAMKeys permission or the ManageIAMKeys permission for a specific key.

The allowlist requires at least 1 IPv4 address or a CIDR range with a prefix from /1 to /32. It can support up to a maximum of 20 unique IPv4 addresses and CIDR ranges.

Edit an allowlist​

To create or update an IP allowlist:

  1. From the Lumi navigation menu, click Keys and select the key you want to add an allowlist to.

  2. Click the edit icon in IP allowlist.

  3. Click Allow specific IPs if it isn't already selected and provide a list of up to 20 IPv4 addresses and CIDR ranges.

    When you provide IPs and CIDR ranges, you can do any of the following:

    • For new or smaller lists, enter them and their optional description manually.
    • For an existing list from a different IAM key, copy the list from that key by going to the source key's IP allowlist and selecting More > Copy list. Go to the target key's IP allowlist and select More > Paste list.
    • For large lists that are new, create a list in a text editor that follows this format:
    IPv4_ADDRESS,DESCRIPTION
    CIDR/PREFIX,DESCRIPTION

    For example:

    192.168.12.123,VPN IP
    192.168.12.125/32,Office
    203.45.128.67,Home

    Copy the list to your system's clipboard, and select More > Paste list.

    Note the following about pasting a list:

    • Pasting a list doesn't overwrite the existing list. It adds any new IPs and CIDR ranges while skipping duplicates.
    • Make sure your browser settings allow Lumi to read from the clipboard.

  4. Save the list.

To remove an entry from the IP allowlist, click the remove icon (X) next to the address and save the change. To grant access to all IPs instead of only allowing some IPs, select Allow all IPs and save the change.

When you create an allowlist or make an update to one, the changes can take up to a minute to apply.

Delete an IAM key​

Deleting an IAM key is a permanent action. It affects all integrations relying on that IAM key for authentication. Before you delete an IAM key, update any related integrations with a new IAM key so the integration can operate without interruption.

To delete an IAM key:

  1. From the Lumi navigation menu, click Keys.
  2. Click the ellipsis next to the IAM key you want to delete.
  3. Click Delete.
  4. When prompted, type the name of the IAM key you want to delete; then click Delete.

Learn more​

For more information, see the following topics: