All Apps and Add-ons

Splunk_TA_aws getting AccessDeniedException and Throttling Exception errors

bishtk
Communicator

Getting below two errors in Splunk_TA_aws. Could you please respond if any have faced the same issue and/or have got resolution?

1) AccessDeniedException:
2018-07-24 01:44:29,520 level=ERROR pid=6376 tid=Thread-11 logger=splunk_ta_aws.modinputs.inspector.aws_inspector_data_loader pos=aws_inspector_data_loader.py:call:304 | | message="Failed to collect inspector findings for region=-east-1, datainput=-inspector, error=Traceback (most recent call last):
File "D:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\inspector\aws_inspector_data_loader.py", line 299, in call
self._do_indexing()
File "D:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\inspector\aws_inspector_data_loader.py", line 280, in _do_indexing
AWSInspectorAssessmentRunsDataLoader(self._config, self._cli, account_id).run()
File "D:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\inspector\aws_inspector_data_loader.py", line 41, in run
self._schedule()
File "D:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\inspector\aws_inspector_data_loader.py", line 56, in _schedule
arns = self._list_completed_runs_in_time_window(begin, end)
File "D:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\inspector\aws_inspector_data_loader.py", line 124, in _list_completed_runs_in_time_window
response = self._cli.list_assessment_runs(
params)
File "D:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\3rdparty\botocore\client.py", line 324, in _api_call
return self._make_api_call(operation_name, kwargs)
File "D:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\3rdparty\botocore\client.py", line 622, in _make_api_call
raise error_class(parsed_response, operation_name)
AccessDeniedException: An error occurred (AccessDeniedException) when calling the ListAssessmentRuns operation: User: arn:aws:iam::413816976474:user/**_splunk is not authorized to perform: inspector:ListAssessmentRuns
"

2) Throttling Exception:
2018-07-20 12:12:03,828 level=ERROR pid=6572 tid=Thread-12 logger=splunk_ta_aws.modinputs.cloudwatch_logs.aws_cloudwatch_logs_data_loader pos=aws_cloudwatch_logs_data_loader.py:describe_cloudwatch_log_streams:73 | | message="Failure in describing cloudwatch logs streams due to throttling exception for log_group=vpc-flow, sleep=3.99032054509, reason=Traceback (most recent call last): File "D:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\cloudwatch_logs\aws_cloudwatch_logs_data_loader.py", line 63, in describe_cloudwatch_log_streams group_name, next_token=buf["nextToken"]) File "D:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\3rdparty\boto\logs\layer1.py", line 308, in describe_log_streams body=json.dumps(params)) File "D:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\3rdparty\boto\logs\layer1.py", line 576, in make_request body=json_body) JSONResponseError: JSONResponseError: 400 Bad Request {u'__type': u'ThrottlingException', u'message': u'Rate exceeded'}

-Thanks

0 Karma

gjanders
SplunkTrust
SplunkTrust

The rate limiting is the reason why I switched a previous environment to AWS firehose as per the blog post " Ready, Set, Stream with the Kinesis Firehose and Splunk Integration" or refer to the kinesis firehose add on documentation

The permissions will likely be AWS related and unfortunately not the easiest thing to get right, I found using the push method much easier and it resulted in no rate limiting which was not avoidable in my previous environment.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...