AWS Generic S3 Integration Error

[rcrabtree]

I am attempting to use a Generic S3 Bucket with CDR files with multiple folders inside to visualize the data. I am getting the following error and not sure why the account isn't found. In building the source Splunk autofills the values and I can log into S3 with the account. What logs or remediation should I do?

File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\generic_s3\aws_s3_data_loader.py", line 86, in index_data
self._do_index_data()
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\generic_s3\aws_s3_data_loader.py", line 107, in _do_index_data
self.collect_data()
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\generic_s3\aws_s3_data_loader.py", line 153, in collect_data
self._discover_keys(index_store)
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\generic_s3\aws_s3_data_loader.py", line 223, in _discover_keys
credentials = self._generate_credentials()
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\modinputs\generic_s3\aws_s3_data_loader.py", line 384, in _generate_credentials
self._config.get(tac.aws_iam_role),
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\common\aws_credentials.py", line 158, in load
credentials = self._load(aws_account_name, aws_iam_role_name)
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_aws\bin\splunk_ta_aws\common\aws_credentials.py", line 169, in _load
raise AWSAccountError('account not found', aws_account_name)
splunk_ta_aws.common.aws_credentials.AWSAccountError: account not found

[venkatasri]

Hi, Following is the basic stanza with minimum settings required in inputs.conf  when you use Access Key Id and Secret Access Key.

[aws_s3://test_generic_s3]
aws_account = TestAWSAccount
bucket_name = your-bucket-name
sourcetype = aws:s3:cdr
index = main
host_name = s3.amazonaws.com
polling_interval = 3600

File - Splunk_TA_aws/local/passwords.conf should be having your account details stored and encrypted. Same you can find in AWS TA UI section, Configuration -> Accounts. Make sure Account Region Category is Global

If you are using IAM role the stanza is little bit different. What type of Access you have to S3 IAM role/ Access Key id?