Getting Access Denied for Splunk Add-on for AWS

[himaniarora20]

I am in a bit of a fix right now and getting the below error when I am trying to add a new input to Splunk using this document 

https://docs.splunk.com/Documentation/AddOns/released/AWS/Setuptheadd-on

Note:  The Splunk instance is in a different account than the S3 bucket.

Error response received from the server: Unexpected error "<class 'splunktaucclib.rest_handler.error.RestError'>" from python handler: "REST Error [400]: Bad Request -- An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied". See splunkd.log/python.log for more details.

I have created an AWS role to allow the user residing in  account where my S3 bucket is and the permissions are like below

Trust relationship:

The user contains s3full access and AssumeRole policy attached to it. 

Splunk config:
The IAM role still shows undiscovered:

Are there any changes required at the Splunk instance level in the other account so that it could access the policy?

TIA for your help!

[Gasp]

BUMP! I am having the same issue with similar config. @himaniarora20 you didnt end up finding a resolution?

[himaniarora20]

I did actually..  Just found out that you need to try with the indexer instead of Search Head. And also, attach an IAM role to your Splunk server, and  use the ARN of that same role to attach to your Splunk config.