Splunk Add-on for AWS

[drggfish1]

I am trying to configure the Splunk Add-on for AWS for brining in CloudTrail logs via SQS S3. I have the following User, Role, and Permissions set up in AWS:

SplunkUser

I have the following permissions defined:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::MYACCOUNTNUMBER:role/SplunkRole"
}
]
}

I have the following SplunkRole defined:

Trust Relationship

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::MYACCOUNTNUMBER:user/SplunkUser"
},
"Action": "sts:AssumeRole",
"Condition": {}
}
]
}

I have the following permissions attached to the Splunk Role and from a previously created "SplunkSQSPolicy"

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:GetQueueAttributes",
"sqs:ListQueues",
"sqs:ReceiveMessage",
"sqs:GetQueueUrl",
"sqs:SendMessage",
"sqs:DeleteMessage",
"s3:ListBucket",
"s3:GetObject",
"s3:GetObjectVersion",
"s3:GetBucketLocation",
"s3:ListAllMyBuckets",
"s3:GetBucketTagging",
"s3:GetAccelerateConfiguration",
"s3:GetBucketLogging",
"s3:GetLifecycleConfiguration",
"s3:GetBucketCORS",
"kms:Decrypt"
],
"Resource": [
"*"
]
}
]
}

I keep getting the following ERROR:

An error occurred (AccessDenied) when calling the ListQueues operation: User: arn:aws:iam::MYACCOUNTNUMBER:user/SplunkUser is not authorized to perform: sqs:listqueues on resource: arn:aws:sqs:us-east-1:MYACCOUNTNUMBER: because no identity-based policy allows the sqs:listqueues action

I am not sure why this is failing, I have the sqs:listqueues API call listed in the Permission Policy.

Please advise,

Thanks!

[drggfish1]

Update - I just added my Role Arn to the configuration for the Splunk Add on for AWS in Splunk.  So in addition to the account information I added the Assume Role information.

It now works. I am assuming this is the way it is supposed to work.

Thoughts?

[livehybrid]

Hi @drggfish1 

It looks like your configuration hasn’t picked up the role assumption as it says that 'arn:aws:iam::MYACCOUNTNUMBER:user/SplunkUser' cannot list the queues when it should actually be the role you have assumed which is listing the queues.

Please can you confirm that you have added the Assume role and selected it for the input? See https://splunk.github.io/splunk-add-on-for-amazon-web-services/ManageAwsIAMRole/ for more details.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[drggfish1]

Thanks for the input livehybrid.

I guess I am still not following the way it is supposed to work.

For me, I have a user SplunkUser that has a trust relationship with SplunkRole. The user SplunkUser is given permissions to "sts:AssumeRole"

After the SplunkUser assumes the SplunkRole - the Role has permissions to list queues but yes, the error implies that the SplunkUser is attempting to list queues, not the Role.

Any further guidance would be welcomed.

Thanks!