Getting Data In

AWS Addon - SNS Signature

kentsaunders
Explorer

After updating the Splunk Add-On for AWS to 5.2.1 we are no longer receiving Cloudtrail data through a proxy server.  The message from the _internal index is "message="Warning: This message does not have a valid SNS Signature <urlopen error [Errno 110] Connection timed out>".  If I bypass the proxy and allow outbound connections from the Splunk server on port 443 (with the proxy enabled in both the addon and server.conf) it is able to retrieve the data.  We are running Splunk Enterprise 8.2.3.2 on a single instance.

Labels (1)
0 Karma

Aatom
Explorer

seeing the same thing on Splunk V8.1.5 Add-on V5.2.1:
2022
-01-11
02:29:48,836 level=WARNING pid=2971768 tid=Thread-2 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=handler.py:_process:299 | datainput="<foo-bar>" start_time=1641868103, message_id="68a1a0a5-64bf-492c-a47d-96f1c3be0fb6" created=1641868188.579236 ttl=300 job_id=c3799c53-fcb9-4150-87f4-913ade22a58b | message="Warning: This message does not have a valid SNS Signature None None doesn't match required format '^https://sns\\.[-a-z0-9]+\\.amazonaws\\.com(?:\\.cn)?/'"

We copied the config from a working V8.1.5 Add-on V5.2.0 system so we can build resiliency using the SQS Queues, but nothing is coming through from the new HF.

0 Karma

kentsaunders
Explorer

After reviewing DNS queries, Proxy logs and the VPC Flow logs it turned out that only the SNS service wouldn't use the proxy.  I was able to resolve the issue by adding an SNS endpoint to the VPC/Subnet that the Splunk instance is connected to.

0 Karma
Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...