Splunk Enterprise on REHL 7 in AWS, how to mount S3 storage data for splunk?

[Log_wrangler]

Hi All,
I know this question leans more to AWS support but I thought I would poll the community for any insight.
I have an EC2 (RHEL7 OS) rolling in AWS and I am in the midst of installing Splunk Enterprise.
I have some Splunk data saved in an S3 bucket, but I am apprehensive about mounting the S3 data to the EC2 instance. I am worried that if not done properly Splunk might overwrite the data in S3.

Does anyone have experience with this?

Are there any caveats regarding the way S3 needs to be connected to Splunk's OS?
I have seen two ways (so far) "IAM role to access S3 buckets" and "Fuse" to connect the data to the OS.
Has anyone successfully tried either way with Splunk?

Thank you

[burakcinar · Accepted solution]

Im using s3 bucket with awscli tool, it's much better than other tools, you can also remove files after sync to s3 bucket automatically.

sample command usage
aws s3 sync ./folderpath s3://mySplunkBucket/

aws s3 commands ;
https://docs.aws.amazon.com/cli/latest/userguide/using-s3-commands.html
https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html

[Log_wrangler]

Thank you for the reply.

I should mention that the data in the S3 bucket is previously indexed data (uploaded via snowball). So I wanted to seamlessly access that data with the aws/ec2/rhel7/splunk enterprise deployment as before. This splunk instance will act as an indexer.

Do you see any issues with this scenario?

I will dig into your links.

Thank you.