All Apps and Add-ons

Configure Splunk Add on for AWS, 'Description (Metadata) inputs' in AWS multiple accounts scenario

shrikant0013
Explorer

I am using Splunk App for AWS 5.1.1, Splunk Add on for AWS 4.5.0, Splunk Enterprise 7.0.4 hosted in AWS environment

I had few questions here
1) Firstly just to confirm 'Metadata input for the Splunk App for AWS'' is same thing as 'Description inputs for the Splunk Add-on for AWS'.
Basically, it going to do Get*/Describe*,List* on following resources ec2_volumes, ec2_instances, ec2_reserved_instances, ebs_snapshots, elastic_load_balancers, vpcs, vpc_network_acls, cloudfront_distributions, vpc_subnets, rds_instances, ec2_key_pairs, ec2_security_groups, s3_buckets. This information is used by Splunk App for AWS to provide more insights

Is my understanding correct?

2) I have Splunk installed in separate AWS account. This is EC2 role based. I want to get 'Description (Metadata) inputs' from 100's of other AWS accounts I have.
To configure this scenario, I have to add role in each account with policy as described here. This role will be assumed by Splunk instance to collect data.

Now, on Splunk side, in Splunk Add on for AWS, I have to add this IAM role.

As per Splunk documentation under 'Manage IAM roles'
Under the Configuration menu, you manage AWS IAM roles that can be assumed by IAM accounts for the Splunk Add-on for AWS to access the following AWS resources: Description, CloudWatch, Kinesis etc

Note: Configuring roles by directly editing splunk_ta_aws_iam_roles.conf is not supported. Use the add-on's Configuration menu in Splunk Web to manage IAM roles. You cannot edit or delete EC2 IAM roles from the add-on.

So how can I add role information of 100's of AWS accounts that I wish Splunk Add on to get 'Description Inputs' from? Manually adding this through Spunk Web won't be scalable process.

Is anyone in similar scenarion? Any advice to share here?

0 Karma

sun1000
Path Finder

I also have the same question, is there any answer for this one ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...