Configure sovereign cloud profiles¶
Use Google Cloud Environment on a Google account to select a supported France S3NS or Germany T-Systems sovereign profile. Each sovereign environment supports its existing Data Boundary deployment and an opt-in Dedicated deployment. Dedicated is not a separate account type.
| Google Cloud Environment | Deployment | Default universe | Default resource and BigQuery location |
|---|---|---|---|
| Commercial Google Cloud | Not applicable | Existing commercial routing | Existing behavior |
| France Data Boundary by S3NS | Data Boundary | Existing googleapis.com routing |
europe-west1, europe-west4, and europe-west9 |
| France Data Boundary by S3NS | Dedicated | s3nsapis.fr |
u-france-east1 |
| Germany Data Boundary by T-Systems | Data Boundary | Existing googleapis.com routing |
europe-west3 and the backward-compatible u-germany-northeast1 value |
| Germany Data Boundary by T-Systems | Dedicated | apis-berlin-build0.goog |
u-germany-northeast1 |
The Germany Dedicated universe is the current provider preview default. If that preview hostname changes in a later add-on release, accounts that leave Universe Domain Override blank inherit the new packaged default. An account with an explicit override remains pinned until an administrator clears or changes it.
Backward compatibility¶
Dedicated is entirely opt-in. If sovereign_deployment is missing, blank, or data_boundary, France and Germany accounts use their existing Data Boundary code path. Upgrades do not migrate or rewrite account or input stanzas, and opening an old stanza does not add new fields. Commercial accounts and existing google_api_endpoints overrides retain their current behavior.
Configure a Dedicated account¶
- In the add-on, open Configuration > Google Credentials and add or edit an account.
- Select France Data Boundary by S3NS or Germany Data Boundary by T-Systems.
- Select Dedicated for Sovereign Deployment.
- Review the effective universe, STS endpoint, IAM Credentials endpoint, and locations shown by the form.
- Supply service-account JSON or external-account JSON for Workload Identity Federation (WIF), then save the account.
Leave the following fields blank to inherit the displayed provider defaults:
- Universe Domain Override (
universe_domain) - STS Token Endpoint Override (
sts_token_endpoint) - IAM Credentials Endpoint Override (
iam_credentials_endpoint) - Google API Endpoints (
google_api_endpoints) - Allowed Resource Locations and Allowed BigQuery Locations
Only override an inherited value when instructed by S3NS or T-Systems. Clearing an override restores inheritance. The add-on derives the blank authentication values as https://sts.<universe>/v1/token and https://iamcredentials.<universe>.
Do not set a process-global universe
Do not set GOOGLE_CLOUD_UNIVERSE_DOMAIN in the Splunk process. The add-on resolves the universe per account so Commercial, Data Boundary, France Dedicated, and Germany Dedicated inputs can run together.
Dedicated credentials¶
Dedicated accounts support service-account JSON and external-account JSON for WIF. Application Default Credentials, authorized-user credentials, and other implicit credential types are not supported for Dedicated.
If credential JSON explicitly declares universe_domain, it must match the account’s effective universe. For WIF, the account-level STS endpoint is authoritative. When impersonation is configured, the add-on uses the account-level IAM Credentials origin and preserves the canonical generateAccessToken resource path.
OAuth scope strings such as https://www.googleapis.com/auth/cloud-platform are permission identifiers, not API destinations, and remain unchanged.
Account and input endpoint overrides¶
Authentication routing is owned only by the account. Inputs cannot override the universe, STS endpoint, IAM Credentials endpoint, or allowed locations.
For a supported input, Dedicated API Endpoint Overrides accepts a JSON map containing only the service origins used by that input. Each value must be an HTTPS origin without credentials, a path, query parameters, or a fragment. Dedicated configuration rejects googleapis.com destinations.
The add-on resolves a data-service endpoint in this order:
- The input’s
google_api_endpoint_overridesvalue for that service. - The account’s existing
google_api_endpointsvalue for that service. https://<service>.<effective-universe>.
An input override changes only that input. It cannot enable a collector or API that the provider profile blocks.
| Input | Allowed input endpoint keys |
|---|---|
| Cloud Pub/Sub | cloudresourcemanager, pubsub |
| Cloud Monitoring | cloudresourcemanager, monitoring |
| Google Cloud BigQuery Billing | cloudresourcemanager, bigquery |
| Pub/Sub-based Bucket | cloudresourcemanager, pubsub, storage |
| Cloud Storage Bucket | cloudresourcemanager, storage |
| Cloud Storage resource metadata | cloudresourcemanager, storage |
| Kubernetes/GKE resource metadata | cloudresourcemanager, container |
Dedicated collector availability¶
France and Germany Dedicated use the same capability policy.
| Collector | Dedicated status |
|---|---|
| Cloud Pub/Sub | Supported by the add-on; provider acceptance is required before a live-support claim |
| Pub/Sub-based Bucket | Supported by the add-on |
| Cloud Storage Bucket | Supported by the add-on |
| Cloud Monitoring | Supported for explicitly selected projects; All is blocked |
| Google Cloud BigQuery Billing | Supported against an existing export table |
| Cloud Storage resource metadata | Buckets and notifications are supported |
| Kubernetes/GKE resource metadata | Supported with an explicit location or the inherited Dedicated location |
| Cloud Pub/Sub Lite | Blocked |
| Compute Engine resource metadata | Blocked pending method-level certification |
| VPC Access resource metadata | Blocked |
| Cloud Storage ACL metadata | bucket_access_controls, default_object_access_controls, and object_access_controls are blocked |
The add-on validates these restrictions before constructing a client or making a service request. Configurable URLs do not constitute provider certification. Do not claim full Dedicated support until the relevant live provider tests have passed.
Provider references¶
- France Data Boundary by S3NS
- Germany Data Boundary by T-Systems
- S3NS supported services
- S3NS Pub/Sub differences
- S3NS uniform bucket-level access
- Google Cloud Dedicated
Customer responsibilities¶
The sovereign profile validates add-on configuration and prevents known unsupported collection paths. It does not guarantee end-to-end data sovereignty after data is ingested into Splunk. Customers remain responsible for provider organization policies, resource placement, CMEK, Pub/Sub storage policy, Splunk deployment location, backups, and retention.