How to use AWS cloudtrail across 20+ accounts

[matt_tunny]

Hey everyone,
We have about 20 AWS accounts at the moment and I want to the use the Splunk AWS app to monitor them all but it looks like it only works in single accounts?
I currently have cloudtrail on all accounts which then go into 1 master s3bucket which we pull the logs down from, also where my splunk instance is sitting. I can get the AWS splunk app working in the aws account i deploy splunk from (using IAM roles from the doco) but I can't see how to pull that type of data from other accounts without setting up 20+ splunk instances?

How does everyone else use the splunk AWS app when you have alot of seperate aws accounts? Is it done through SQS or something?

Thanks!

[pchen_splunk · Accepted solution]

Hi

SNS+SQS on CloudTrail is used to collecting CloudTrail message. You can set up accounts first, then setup cloudtrail with SNS and SQS. Then, add SQS in the AWS app GUI.

Meanwhile, pull CloudTrail message from S3 may be supported in the future.

[matt_tunny]

ok thanks, I tried setting that up before but it keeps giving me access denied even thought my account has Administrator rights in aws.
Do you know of any blogs that have set this up before?

[matt_tunny]

It's giving me access denied to even root accounts when trying to add SQS app. I saw another question saying there is currently a bug adding SQS into the app?

[pchen_splunk]

If you got "access denied", please check your AWS IAM setting. Here is ref: http://docs.splunk.com/Documentation/AWS/4.2.0/Installation/ConfigureyourAWSpermissions#Configure_Cl...

Yes, there is a bug in AWS app 4.2.0 about SQS list. You can got my answer in https://answers.splunk.com/answers/421913/bug-in-splunk-app-for-aws-user-unable-to-configure.html#an... . Or you can wait for the 4.2.1 release, which should happen this month.

To dig deeper to the issue you met, please file a support ticket.