Deploy Splunk indexer and Heavy Forwarder on ECS Managed Instance

[yassenfouadanis]

Hi,
I'm trying to deploy Splunk indexer and Heavy forwarder using image 9.4 on ECS Managed Instance using EBS volumes but the problem that i'm facing is a permission denied all what I'm doing just put the environments needed and  such as:

ENV SPLUNK_START_ARGS="--accept-license"

ENV SPLUNK_PASSWORD="ChangeMe123!"

ENV SPLUNK_ROLE="splunk_heavy_forwarder"

ENV SPLUNK_INDEXER_URL="idx1.splunk.local:9997"

ENV SPLUNK_GENERAL_TERMS="--accept-sgt-current-at-splunk-com"

So, i appreciate if someone can advice 

[thahir]

@yassenfouadanis 

It looks like this is a permissions issue. Because ECS Managed Instances don’t allow you to run commands directly on the host, you’ll need to fix it in the task definition instead.

Please go to the ECS console, create a new revision of the task definition with your parameters, and add "user": "0" to the container definition (before the environment variables section).

This will run the Splunk container as the root user so it can write to the EBS volume. Once everything is working, we can adjust the user configuration if needed.

[livehybrid]

Hi @yassenfouadanis 

Are you mounting a path from your EBS volume into your container? What permissions are on that folder? 

I believe the UID/GID for the Splunk user inside the container will be 41812 so you could try and change the ownership of that path on your EBS volume using:

chown -R 41812:41812 /your/path/here 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[yassenfouadanis]

Hi@livehybrid,
Thanks for your reply, ECS Managed Instance is creating for you EBS volume but you don't have access to modify on it either the EC2 itself you cannot access so i'm not be able to do any kind of modifications related to the permissions,  it's a new service published by AWS since September 2025   

[thahir]

@yassenfouadanis  from the logs i can see the issue is because of permission

when mounting EBS volume to the container, you should set the owner as splunk

before launching splunk use the below command to change the permission to splunk as a owner

chown -R splunk:splunk /opt/splunk

[yassenfouadanis]

@thahir  This new AWS service(ECS Managed Instance) is not offering to manage the EBS and do the changes needed