I am trying to configure the Splunk Add-on for AWS for brining in CloudTrail logs via SQS S3. I have the following User, Role, and Permissions set up in AWS: SplunkUser I have the following permissions defined: { "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::MYACCOUNTNUMBER:role/SplunkRole" } ] } I have the following SplunkRole defined: Trust Relationship { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::MYACCOUNTNUMBER:user/SplunkUser" }, "Action": "sts:AssumeRole", "Condition": {} } ] } I have the following permissions attached to the Splunk Role and from a previously created "SplunkSQSPolicy" { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "sqs:GetQueueUrl", "sqs:SendMessage", "sqs:DeleteMessage", "s3:ListBucket", "s3:GetObject", "s3:GetObjectVersion", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:GetBucketTagging", "s3:GetAccelerateConfiguration", "s3:GetBucketLogging", "s3:GetLifecycleConfiguration", "s3:GetBucketCORS", "kms:Decrypt" ], "Resource": [ "*" ] } ] } I keep getting the following ERROR: An error occurred (AccessDenied) when calling the ListQueues operation: User: arn:aws:iam::MYACCOUNTNUMBER:user/SplunkUser is not authorized to perform: sqs:listqueues on resource: arn:aws:sqs:us-east-1:MYACCOUNTNUMBER: because no identity-based policy allows the sqs:listqueues action I am not sure why this is failing, I have the sqs:listqueues API call listed in the Permission Policy. Please advise, Thanks! ... View more