Installation

Do Splunk Enterprise security upgrades result in a new AWS AMI being released?

mihaibarzu
New Member

My team is considering running Splunk Enterprise on EC2, and wants to understand the operational load we'll incur due to regular security upgrades.
Rather than go through the various manual steps each upgrade recommends, we were considering taking advantage of EC2's ASG, spinning up replacement capacity using the latest Splunk AMI and spinning down old capacity once the replacements are up. For this to work, each Splunk security upgrade should result in a new Splunk AMI being published.
1. Are new AMIs being published on all Splunk security upgrades, or only on major version upgrades?
1.1 If new AMIs are being published on all Splunk security upgrades, is there any delay between the vulnerability and fix being published and the new AMI being released?
1.2 If new AMIs are not being published on all Splunk security upgrades, then what happens on a fresh install of the Splunk AMI on an EC2 instance? Do all recent security patches need to be applied manually?

Labels (1)
0 Karma

PeterB2
Observer

Can we have an answer on that? thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...