I am using Splunk App for AWS 5.1.1, Splunk Add on for AWS 4.5.0, Splunk Enterprise 7.0.4 hosted in AWS environment
I had few questions here
1) Firstly just to confirm 'Metadata input for the Splunk App for AWS'' is same thing as 'Description inputs for the Splunk Add-on for AWS'.
Basically, it going to do Get*/Describe*,List* on following resources ec2_volumes, ec2_instances, ec2_reserved_instances, ebs_snapshots, elastic_load_balancers, vpcs, vpc_network_acls, cloudfront_distributions, vpc_subnets, rds_instances, ec2_key_pairs, ec2_security_groups, s3_buckets . This information is used by Splunk App for AWS to provide more insights
Is my understanding correct?
2) I have Splunk installed in separate AWS account. This is EC2 role based. I want to get 'Description (Metadata) inputs' from 100's of other AWS accounts I have.
To configure this scenario, I have to add role in each account with policy as described here. This role will be assumed by Splunk instance to collect data.
Now, on Splunk side, in Splunk Add on for AWS, I have to add this IAM role.
As per Splunk documentation under 'Manage IAM roles'
Under the Configuration menu, you manage AWS IAM roles that can be assumed by IAM accounts for the Splunk Add-on for AWS to access the following AWS resources: Description, CloudWatch, Kinesis etc
Note: Configuring roles by directly editing splunk_ta_aws_iam_roles.conf is not supported. Use the add-on's Configuration menu in Splunk Web to manage IAM roles. You cannot edit or delete EC2 IAM roles from the add-on.
So how can I add role information of 100's of AWS accounts that I wish Splunk Add on to get 'Description Inputs' from? Manually adding this through Spunk Web won't be scalable process.
Is anyone in similar scenarion? Any advice to share here?
... View more
