I used Splunk Add on for AWS to send log files stored in S3 to SQS using S3 event notifications, and configured Splunk to read the log files from SQS.
However, I got an error saying that the S3 test message that is always sent first by S3 event notifications could not be parsed.
Splunk on EC2 is given KMS decryption privileges as shown below.
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"sqs:*",
"s3:*",
"kms:Decrypt"
],
"Resource": [
"arn:aws:sqs:ap-northeast-1:*************:poc-splunk-vpcflowlog*",
"arn:aws:s3:::poc-splunk-vpcflowlog",
"arn:aws:s3:::poc-splunk-vpcflowlog/*"
What could be the cause?
