All Apps and Add-ons

Configure Splunk Add on for AWS, 'Description (Metadata) inputs' in AWS multiple accounts scenario


I am using Splunk App for AWS 5.1.1, Splunk Add on for AWS 4.5.0, Splunk Enterprise 7.0.4 hosted in AWS environment

I had few questions here
1) Firstly just to confirm 'Metadata input for the Splunk App for AWS'' is same thing as 'Description inputs for the Splunk Add-on for AWS'.
Basically, it going to do Get*/Describe*,List* on following resources ec2_volumes, ec2_instances, ec2_reserved_instances, ebs_snapshots, elastic_load_balancers, vpcs, vpc_network_acls, cloudfront_distributions, vpc_subnets, rds_instances, ec2_key_pairs, ec2_security_groups, s3_buckets. This information is used by Splunk App for AWS to provide more insights

Is my understanding correct?

2) I have Splunk installed in separate AWS account. This is EC2 role based. I want to get 'Description (Metadata) inputs' from 100's of other AWS accounts I have.
To configure this scenario, I have to add role in each account with policy as described here. This role will be assumed by Splunk instance to collect data.

Now, on Splunk side, in Splunk Add on for AWS, I have to add this IAM role.

As per Splunk documentation under 'Manage IAM roles'
Under the Configuration menu, you manage AWS IAM roles that can be assumed by IAM accounts for the Splunk Add-on for AWS to access the following AWS resources: Description, CloudWatch, Kinesis etc

Note: Configuring roles by directly editing splunk_ta_aws_iam_roles.conf is not supported. Use the add-on's Configuration menu in Splunk Web to manage IAM roles. You cannot edit or delete EC2 IAM roles from the add-on.

So how can I add role information of 100's of AWS accounts that I wish Splunk Add on to get 'Description Inputs' from? Manually adding this through Spunk Web won't be scalable process.

Is anyone in similar scenarion? Any advice to share here?

0 Karma


I also have the same question, is there any answer for this one ?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!