@cloudlockmatt I also faced the same issue and I was able to resolve the issue by providing the below permission to the AWS account or role configured on the Splunk Add on for AWS.  kms:ListAliases kms:Decrypt s3:GetBucketLocation S3:GetBucketObject - In my case, I have missed this permission  s3:ListAllMyBuckets s3:PutBucketAcl s3:PutBucketPolicy s3:PutObject ... View more