Splunk Add-on for VPC logs on AWS GovCloud

[leontp587]

I'm trying to ingest VPC logs into Splunk using the Splunk add-on for AWS 2.0.1. My VPC logs are in GovCloud, but GovCloud isn't an option on the "Add AWS CloudWatch Logs Input" dialog. Is AWS GovCloud VPC logs supported for Splunk?

[Jeremiah]

This looks like its a limitation of the AWS boto library. When you add an input using the AWS add-on, Splunk uses a REST endpoint to list the regions for the particular service you're selecting. That Splunk REST endpoint is using the Python boto library to list out the regions:

elif self.callerArgs.data['aws_service'][0] in ('cloudwatch-logs', 'cloudwatchlog', 'cloudwatchlogs'):
            import boto.logs
            regions = boto.logs.regions()

Running this bit of python code in the REPL shows:

>>> import boto.logs
>>> regions = boto.logs.regions()
>>> print regions
[RegionInfo:us-east-1, RegionInfo:ap-northeast-1, RegionInfo:ap-northeast-2, RegionInfo:ap-southeast-1, RegionInfo:ap-southeast-2, RegionInfo:us-west-2, RegionInfo:us-west-1, RegionInfo:eu-central-1, RegionInfo:eu-west-1]

As opposed to the same command for Cloudwatch metrics (notice us-gov-west-1 is listed):

>>> import boto.ec2.cloudwatch
>>> regions = boto.ec2.cloudwatch.regions()
>>> print regions
[RegionInfo:us-east-1, RegionInfo:cn-north-1, RegionInfo:ap-northeast-1, RegionInfo:ap-southeast-2, RegionInfo:sa-east-1, RegionInfo:ap-southeast-1, RegionInfo:ap-northeast-2, RegionInfo:us-west-2, RegionInfo:us-gov-west-1, RegionInfo:us-west-1, RegionInfo:eu-central-1, RegionInfo:eu-west-1]