AWS Addon - SNS Signature

[kentsaunders]

After updating the Splunk Add-On for AWS to 5.2.1 we are no longer receiving Cloudtrail data through a proxy server.  The message from the _internal index is "message="Warning: This message does not have a valid SNS Signature <urlopen error [Errno 110] Connection timed out>".  If I bypass the proxy and allow outbound connections from the Splunk server on port 443 (with the proxy enabled in both the addon and server.conf) it is able to retrieve the data.  We are running Splunk Enterprise 8.2.3.2 on a single instance.

[Aatom]

seeing the same thing on Splunk V8.1.5 Add-on V5.2.1:
2022-01-11 02:29:48,836 level=WARNING pid=2971768 tid=Thread-2 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=handler.py:_process:299 | datainput="<foo-bar>" start_time=1641868103, message_id="68a1a0a5-64bf-492c-a47d-96f1c3be0fb6" created=1641868188.579236 ttl=300 job_id=c3799c53-fcb9-4150-87f4-913ade22a58b | message="Warning: This message does not have a valid SNS Signature None None doesn't match required format '^https://sns\\.[-a-z0-9]+\\.amazonaws\\.com(?:\\.cn)?/'"

We copied the config from a working V8.1.5 Add-on V5.2.0 system so we can build resiliency using the SQS Queues, but nothing is coming through from the new HF.

[kentsaunders]

After reviewing DNS queries, Proxy logs and the VPC Flow logs it turned out that only the SNS service wouldn't use the proxy.  I was able to resolve the issue by adding an SNS endpoint to the VPC/Subnet that the Splunk instance is connected to.