Splunk App for AWS: What information is required to configure AWS Account details?

[briangmadden]

Hi,

I'm trying to configure the Inputs within the Splunk App for AWS through Splunk Web. It is asking for AWS Account Access Key ID and
AWS Account Secret Access Key. Can somebody confirm exactly what information is required here and where in the AWS Console I get the information from?

[nickhills · Accepted solution]

You will need to generate a set of AWS IAM credentials using the AWS console or command line tools.

You will first need to create an IAM user, and this will allow you to download some credentials (these are what you supply to splunk)
You will then need to apply a policy to you new user which will tell AWS what you user is allowed to do. This link contains a sample policy doc which you can use. http://docs.splunk.com/Documentation/AddOns/released/AWS/ConfigureAWSpermissions

You should bear in mind that whilst the default permissions only provide the app read access, you should carefully review the IAM policy to make sure you understand each of the permission it grants.

[briangmadden]

Thanks, I got that bit configured. Getting an error now that user is not authorised to perform sts:AssumeRole on the role. When I log into AWS Console I'm successfully able to switch to the role.