topic Re: AWS Addon - SNS Signature in Getting Data In

AWS Addon - SNS Signature

kentsaunders — Tue, 04 Jan 2022 22:40:02 GMT

After updating the Splunk Add-On for AWS to 5.2.1 we are no longer receiving Cloudtrail data through a proxy server. The message from the _internal index is "message="Warning: This message does not have a valid SNS Signature <urlopen error [Errno 110] Connection timed out>". If I bypass the proxy and allow outbound connections from the Splunk server on port 443 (with the proxy enabled in both the addon and server.conf) it is able to retrieve the data. We are running Splunk Enterprise 8.2.3.2 on a single instance.

Re: AWS Addon - SNS Signature

Aatom — Tue, 11 Jan 2022 02:41:27 GMT

seeing the same thing on Splunk V8.1.5 Add-on V5.2.1:
2022-01-11 02:29:48,836 level=WARNING pid=2971768 tid=Thread-2 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=handler.py:_process:299 | datainput="<foo-bar>" start_time=1641868103, message_id="68a1a0a5-64bf-492c-a47d-96f1c3be0fb6" created=1641868188.579236 ttl=300 job_id=c3799c53-fcb9-4150-87f4-913ade22a58b | message="Warning: This message does not have a valid SNS Signature None None doesn't match required format '^https://sns\\.[-a-z0-9]+\\.amazonaws\\.com(?:\\.cn)?/'"

We copied the config from a working V8.1.5 Add-on V5.2.0 system so we can build resiliency using the SQS Queues, but nothing is coming through from the new HF.

Re: AWS Addon - SNS Signature

kentsaunders — Tue, 11 Jan 2022 14:21:46 GMT

After reviewing DNS queries, Proxy logs and the VPC Flow logs it turned out that only the SNS service wouldn't use the proxy. I was able to resolve the issue by adding an SNS endpoint to the VPC/Subnet that the Splunk instance is connected to.