Splunk servers on AWS - externalise configuration

[Karthikeya]

Hi we have a splunk clustered environment hosted on AWS environment. Normally we are using Ssmsessionmanager role to login to instances and make the changes and day to day tasks. Now our organisation is asking not to use Ssmsessionmanager role anymore and start externalising our configurations from the instances and make instances stateless. And use the run command from SSM manager. I am not aware of all these. I have AWS CCP level knowledge and in mid of preparing SAA. I have zero knowledge on these things. How to proceed further on this? We have PS available not sure whether splunk can do this? Anyone with similar worked earlier? Please shed your thoughts.

As of now, we have ami in dev environment, installing splunk in it and promoting to prod for every 45 days as a part of compliance. But we do on-boardings on weekly basis and we are using config explorer for that in frontend. But to create new integrations or creating HEC token we need access to prod environment and now they are not allowing at all.

[livehybrid]

Hi @Karthikeya 

What does your architecture look like here? Is this a single standalone instance? 

Have you looked at Splunk Ansible (https://splunk.github.io/splunk-ansible/) ? It might be that you can maintain your configuration for Ansible in S3 or AWS SM Parameter store and then trigger a run-command to apply your changes - depending on the type of changes you're looking to apply and your architecture this might be an option?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing