Any recommendations on how to proceed with the installation of AWS Add On in Splunk?

[SplunkDash]

Hello,

Do you have any recommendations on how to proceed with the installation of AWS Add On in SPLUNK. Does REST API call from AWS Add on needs to have any Authentication Token?

Thank you so much for your support in advance.

[caiosalonso]

Hi,

If you are installing the Splunk Add-on for AWS, you will need to configure an IAM role and create a user with an access key (the add-on needs the Key ID and Secret Key). The following link describes what you need in order to configure an AWS account in the add-on: https://docs.splunk.com/Documentation/AddOns/latest/AWS/Setuptheadd-on

[SplunkDash]

Hello,

Thank you so much for your quick response and the important resources you provided, truly appreciate it.

I have one group of people they have IAM role configured and created a user with an access key and already Installed AWS-Add-On on their Cloud Server/host. Is it possible for me to use the same credentials like Key ID and Secret Key to Install AWS-Add-On  on my On-Prem HF? Thank you again!

[caiosalonso · Accepted solution]

Since you already have the Key ID, Secret Key and an IAM role, I guess you can use then to configure the AWS Add-on on your Heavy Forwarder, no problem. I would recommend creating a separate user and role just for security reasons, but if this is not an issue in your environment there is no problem in usnig the existing ones.

You just need to make sure the IAM role will have the necessary permissions for each kind of input you plan to add.

I recommend you to follow the steps on the following docs:

Add an AWS account: https://docs.splunk.com/Documentation/AddOns/released/AWS/Setuptheadd-on#Add_and_manage_AWS_accounts 

Add an IAM role: https://docs.splunk.com/Documentation/AddOns/released/AWS/Setuptheadd-on#Add_and_manage_IAM_roles