https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/563055#M9695 <P>I am getting this error only when I try to configure input for any AWS resource using Generic S3 option</P> Thu, 12 Aug 2021 11:14:29 GMT subramanianers 2021-08-12T11:14:29Z https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/562961#M9684 <P>I am trying to set up Splunk Add-on for AWS to pull my logs from my AWS account into splunk. I have a Splunk Enterprise setup on prem in an AWS EC2 server. I used the Splunk Enterprise AMI. I have attached an EC2 instance role that has administrator access. When I try to configure an input, I get the error -&nbsp;<SPAN>Unexpected error "&lt;class 'splunktaucclib.rest_handler.error.RestError'&gt;" from python handler: "REST Error [400]: Bad Request -- An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid. Please make sure the AWS Account and Assume Role are correct.". See splunkd.log/python.log for more details.</SPAN></P><P>&nbsp;</P><P><SPAN>Note: I did not add any account or IAM role manually in the Splunk UI. The IAM role was autodiscovered by Splunk, and is visible in the Account tab in the Configurations page.</SPAN></P> Wed, 11 Aug 2021 16:44:17 GMT https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/562961#M9684 subramanianers 2021-08-11T16:44:17Z https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/562962#M9685 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/237362">@subramanianers</a>&nbsp;I guess it's something to do with the IAM role attached to your EC2 instance.</P><P>&nbsp;you can try removing it and attach new IAM role and see if that works ?</P> Wed, 11 Aug 2021 17:12:55 GMT https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/562962#M9685 sanjeev543 2021-08-11T17:12:55Z https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/562963#M9686 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/82711">@sanjeev543</a>&nbsp;I have tried it several times. It did not work.</P> Wed, 11 Aug 2021 17:20:56 GMT https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/562963#M9686 subramanianers 2021-08-11T17:20:56Z https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/563021#M9691 <P>I have also created a user with admin privileges, and configured its access id and secret key in Accounts tab in Configuration page. Even while using that account to configure an input, I am getting the same error.</P> Thu, 12 Aug 2021 05:14:24 GMT https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/563021#M9691 subramanianers 2021-08-12T05:14:24Z https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/563055#M9695 <P>I am getting this error only when I try to configure input for any AWS resource using Generic S3 option</P> Thu, 12 Aug 2021 11:14:29 GMT https://community.splunk.com/t5/Splunk-Enterprise/Unable-to-configure-input-on-Splunk-Enterprise-with-Splunk-Add/m-p/563055#M9695 subramanianers 2021-08-12T11:14:29Z