My team is considering running Splunk Enterprise on EC2, and wants to understand the operational load we'll incur due to regular security upgrades.
Rather than go through the various manual steps each upgrade recommends, we were considering taking advantage of EC2's ASG, spinning up replacement capacity using the latest Splunk AMI and spinning down old capacity once the replacements are up. For this to work, each Splunk security upgrade should result in a new Splunk AMI being published.
1. Are new AMIs being published on all Splunk security upgrades, or only on major version upgrades?
1.1 If new AMIs are being published on all Splunk security upgrades, is there any delay between the vulnerability and fix being published and the new AMI being released?
1.2 If new AMIs are not being published on all Splunk security upgrades, then what happens on a fresh install of the Splunk AMI on an EC2 instance? Do all recent security patches need to be applied manually?
