topic Deploy Splunk indexer and Heavy Forwarder on ECS Managed Instance in Splunk Enterprise

Deploy Splunk indexer and Heavy Forwarder on ECS Managed Instance

yassenfouadanis — Thu, 13 Nov 2025 09:49:47 GMT

Hi,
I'm trying to deploy Splunk indexer and Heavy forwarder using image 9.4 on ECS Managed Instance using EBS volumes but the problem that i'm facing is a permission denied all what I'm doing just put the environments needed and such as:

ENV SPLUNK_START_ARGS="--accept-license"

ENV SPLUNK_PASSWORD="ChangeMe123!"

ENV SPLUNK_ROLE="splunk_heavy_forwarder"

ENV SPLUNK_INDEXER_URL="idx1.splunk.local:9997"

ENV SPLUNK_GENERAL_TERMS="--accept-sgt-current-at-splunk-com"

So, i appreciate if someone can advice

Re: Deploy Splunk indexer and Heavy Forwarder on ECS Managed Instance

thahir — Thu, 13 Nov 2025 11:00:16 GMT

@yassenfouadanis from the logs i can see the issue is because of permission

when mounting EBS volume to the container, you should set the owner as splunk

before launching splunk use the below command to change the permission to splunk as a owner

chown -R splunk:splunk /opt/splunk

Re: Deploy Splunk indexer and Heavy Forwarder on ECS Managed Instance

livehybrid — Thu, 13 Nov 2025 11:05:16 GMT

Hi @yassenfouadanis

Are you mounting a path from your EBS volume into your container? What permissions are on that folder?

I believe the UID/GID for the Splunk user inside the container will be 41812 so you could try and change the ownership of that path on your EBS volume using:

chown -R 41812:41812 /your/path/here

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Deploy Splunk indexer and Heavy Forwarder on ECS Managed Instance

yassenfouadanis — Thu, 13 Nov 2025 12:28:17 GMT

Hi@livehybrid,
Thanks for your reply, ECS Managed Instance is creating for you EBS volume but you don't have access to modify on it either the EC2 itself you cannot access so i'm not be able to do any kind of modifications related to the permissions, it's a new service published by AWS since September 2025

Re: Deploy Splunk indexer and Heavy Forwarder on ECS Managed Instance

yassenfouadanis — Thu, 13 Nov 2025 13:12:01 GMT

@thahir This new AWS service(ECS Managed Instance) is not offering to manage the EBS and do the changes needed

Re: Deploy Splunk indexer and Heavy Forwarder on ECS Managed Instance

thahir — Sun, 16 Nov 2025 09:37:18 GMT

@yassenfouadanis

It looks like this is a permissions issue. Because ECS Managed Instances don’t allow you to run commands directly on the host, you’ll need to fix it in the task definition instead.

Please go to the ECS console, create a new revision of the task definition with your parameters, and add "user": "0" to the container definition (before the environment variables section).

This will run the Splunk container as the root user so it can write to the EBS volume. Once everything is working, we can adjust the user configuration if needed.