All Apps and Add-ons

Splunk Add-on for AWS: Does this add-on support Server Side Encryption/ Decryption of Kinesis stream?

New Member

Hi ,
We encrypted Kinesis stream : using Server Sided Encryption. We then have the Splunk Addon for AWS with the IAM instance profile role which has the decrypt for the KMS but when we look at the logs to see if its flowing or not , we are not seeing any logs coming in - does Splunk Add-on for AWS supports the decryption of the encrypted Kinesis stream records?

0 Karma

Splunk Employee
Splunk Employee

I believe it should, the key is to include "kms:Decrypt" in the permission policy:

Splunk Employee
Splunk Employee

Hmmm, it sounds like you did things right. Does it work when the Kinesis stream is not encrypted?

The only thing I see sounds like you already ready it:

0 Karma

Splunk Employee
Splunk Employee

According to our docs mentioned above:

Note: "The Kinesis data input only supports gzip compression or plaintext data. It cannot ingest data with other encodings, nor can it ingest data with a mix of gzip and plaintext in the same input. Create separate Kinesis inputs for gzip data and plaintext data."

So it looks like we do not have a way to read encrypted Kinesis streams with the current Add-on.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...