All Apps and Add-ons

Splunk Add-on for Amazon Web Services: How to configure an AWS Cloudtrail SQS Input on Splunk in a private network?

Venkat_16
Contributor

We have our dedicated Splunk Environment setup on AWS with Indexer and Search Head Clustering.
- Splunk App for AWS is installed on Splunk Search Head Cluster
- Splunk Add-on for Amazon Web Services is installed on a dedicated single instance server (Heavy Forwarder)

All our Splunk servers on AWS Cloud do NOT have connectivity to Internet.
They have only Private IPs - dedicated VPC/Subnet.

We are unable to configure AWS Add-On CloudTrail Input.
The SQS Queue are not getting populated on the drop-down.

What I doubt is, since we do not have connectivity to internet, the Heavy Forwarder is unable to connect to AWS API and get the required queue details, etc.
We do not want to open our AWS servers to the Internet.

For now, we have configured the AWS add-on on our on-prem Heavy Forwarder and pushing data to Indexers on AWS.
We are worrying about unnecessary data transfer between AWS API->On-Prem HF->AWS Indexers.

How do we approach this issue?

0 Karma

pchen_splunk
Splunk Employee
Splunk Employee

please refer to this: https://answers.splunk.com/answers/421913/bug-in-splunk-app-for-aws-user-unable-to-configure.html#an...

I think we should have a NAT instance in your VPC as well. Otherwise, how does addon collect cloudtrail information?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...