@cloudlockmatt I also faced the same issue and I was able to resolve the issue by providing the below permission to the AWS account or role configured on the Splunk Add on for AWS. kms:ListAliases kms:Decrypt s3:GetBucketLocation S3:GetBucketObject - In my case, I have missed this permission s3:ListAllMyBuckets s3:PutBucketAcl s3:PutBucketPolicy s3:PutObject
... View more