About joeydenbroeder

joeydenbroeder · ‎12-27-2018

When configuring the CloudWatch Logs input, there's no option to select the AssumeRole policy like there is for regular CloudWatch input. That presents a bit of an issue when you want to ingest CloudWatch Logs from multiple accounts without having to create an IAM User in each account. Is this a known issue, or am I looking at it the wrong way?

joeydenbroeder · ‎12-27-2018

What we've done is two things: Create an IAM Role with the appropriate permissions in each AWS Account, specifically for Splunk. Attach an IAM Policy to the EC2 IAM Role (in your case SplunkEC2Role) which allows sts:AssumeRole for those IAM Roles. The documentation is pretty good on this subject: https://docs.splunk.com/Documentation/AddOns/released/AWS/ConfigureAWSpermissions

joeydenbroeder · ‎06-11-2018

I've been able to resolve this issue by disabling HTTP/2 on our ALB. We're running Splunk Enterprise 7.1.0 and were seeing 73286 requests per hour of which 1205 were ELB 502 errors (0,16%). Directly after disabling HTTP/2 on the ALB, we are seeing 0 ELB 502 errors. Next question is: Why does it break?

Posts	3
Solutions	1
Karma Given	7
Karma Received	9
Member Since	‎06-11-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

AssumeRole for CloudWatch Logs input

AssumeRole for CloudWatch Logs input

Re: Would any of our AWS experts be able to assist...

Re: Fixing 502 errors when front-ending Search Hea...