I'm trying to configure Cloudtrail in the Splunk for AWS app. I fill in my fields and click on the SQS queue name drop down field and I get the following error:
Failed to fetch data: In handler 'splunk_ta_aws_sqs_queue_names': Unexpected error "" from python handler: "'SSLError' object has no attribute 'status'". See splunkd.log for more details.
Why?
(This is a work in progress, no final answer yet.)
This is acting like it's missing the ListQueues permission. Review the AWS permissions that are configured and make sure the following are setup:
Required permission for the SQS subscribed to the S3 bucket that collects CloudTrail logs: ReceiveMessage, SendMessage, ListQueues, GetQueueUri
Per this doc page: http://docs.splunk.com/Documentation/AddOns/latest/AWS/ConfigureAWSpermissions