Deployment Architecture

AWS ADD-ON config on HF in AWS with Multiple Accounts

radam2000
Path Finder

Thanks in advance for any responses...

Scenario: I have a Heavy Forwarder Installed in my AWS environment sending my data to splunk cloud... works fine for any servers in AWS with a UF sending to HF and then to cloud

We have two accounts:
AccountA has a read-only access right assigned for an audit role across all services. And has read-only access to an S3 storage bucket containing all logs... AWS forwarder is an EC2 instance under this account
We created a User in AccountA with With Cross-Account Assume Permission that will enable it to assume a role in AccountB with Full Read-Only Access to S3 bucket but get errors...

AccountB has a logging archive role and read-only access to an S3 bucket where all logs from all services are written to the S3 bucket.

what is the best way to configure the add-on to pull the logs from this s3 bucket...

there are so many input options but we tried S3 Inputs/Access Logs/Generic S3 with the account and role...

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...