All Apps and Add-ons

How to configure Splunk to use a KMS key to decrypt s3 logs via the Splunk Add-on for AWS?

Glasses
Builder

I was able to successfully read logs from an s3 bucket, with Splunk using AWS add-on configured with an account with a KeyID and Secret Key.

Recently the logs were encrypted via KMS. Now the logs are coming in garbled - because splunk cannot decrpyt.

I am unable to find clear documentation/steps to install the KMS key for splunk to decrypt the logs.

Any direction appreciated.

Thank you!

dbarrpsu
Explorer

The IAM user/group or role you're using for collection needs permissions to decrypt using the key, specifically the "kms:Decrypt" action. This can be scoped to just the KMS key used on the bucket you're collecting from. An example policy document:

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "kms:Decrypt",
        "Resource": "ARN-OF-KMS-KEY"
      }
    ]
}
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...