Getting Data In

AWS Addon - SNS Signature

kentsaunders
Explorer

After updating the Splunk Add-On for AWS to 5.2.1 we are no longer receiving Cloudtrail data through a proxy server.  The message from the _internal index is "message="Warning: This message does not have a valid SNS Signature <urlopen error [Errno 110] Connection timed out>".  If I bypass the proxy and allow outbound connections from the Splunk server on port 443 (with the proxy enabled in both the addon and server.conf) it is able to retrieve the data.  We are running Splunk Enterprise 8.2.3.2 on a single instance.

Labels (1)
0 Karma

Aatom
Explorer

seeing the same thing on Splunk V8.1.5 Add-on V5.2.1:
2022
-01-11
02:29:48,836 level=WARNING pid=2971768 tid=Thread-2 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=handler.py:_process:299 | datainput="<foo-bar>" start_time=1641868103, message_id="68a1a0a5-64bf-492c-a47d-96f1c3be0fb6" created=1641868188.579236 ttl=300 job_id=c3799c53-fcb9-4150-87f4-913ade22a58b | message="Warning: This message does not have a valid SNS Signature None None doesn't match required format '^https://sns\\.[-a-z0-9]+\\.amazonaws\\.com(?:\\.cn)?/'"

We copied the config from a working V8.1.5 Add-on V5.2.0 system so we can build resiliency using the SQS Queues, but nothing is coming through from the new HF.

0 Karma

kentsaunders
Explorer

After reviewing DNS queries, Proxy logs and the VPC Flow logs it turned out that only the SNS service wouldn't use the proxy.  I was able to resolve the issue by adding an SNS endpoint to the VPC/Subnet that the Splunk instance is connected to.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...