All Apps and Add-ons

How to configure Splunk to use a KMS key to decrypt s3 logs via the Splunk Add-on for AWS?

Glasses
Builder

I was able to successfully read logs from an s3 bucket, with Splunk using AWS add-on configured with an account with a KeyID and Secret Key.

Recently the logs were encrypted via KMS. Now the logs are coming in garbled - because splunk cannot decrpyt.

I am unable to find clear documentation/steps to install the KMS key for splunk to decrypt the logs.

Any direction appreciated.

Thank you!

dbarrpsu
Explorer

The IAM user/group or role you're using for collection needs permissions to decrypt using the key, specifically the "kms:Decrypt" action. This can be scoped to just the KMS key used on the bucket you're collecting from. An example policy document:

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "kms:Decrypt",
        "Resource": "ARN-OF-KMS-KEY"
      }
    ]
}
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...