Add AWS accounts for the Splunk App for AWS

When you open the Splunk App for AWS, the app displays an Overview dashboard. This dashboard had no data in it yet, because you first need to configure your AWS account(s) and enable your data inputs.

Prerequisites

Before you proceed, confirm that you have configured your AWS accounts and services in the AWS Management Console and configured sufficient IAM permissions for at least one account. If you have not yet completed those steps, go back to the Before You Deploy chapter in this manual for instructions and guidance.

Use this procedure only if you fall into one of these categories:

• You are using Splunk Cloud
• You are using a singe-instance or trial installation of Splunk Enterprise
• You are using a distributed Splunk Enterprise, and you have followed the procedure to connect your search head to your forwarder using the remote target command.

If you do not fall into these categories, do not use the Configure tab in the app. Instead go to your forwarder and configure your accounts and inputs using the add-on instead.

Add accounts using the Configure tab in the app

1. Open the Splunk App for AWS.

2. Click Configure on the app navigation bar. This tab is only visible to Splunk administrators.

3. On the Configure page, click Add AWS Account.

4. Enter a Friendly Name to identify the account. Use only alphanumeric characters.

5. Enter the Access Key ID for the AWS account that you want the app to use to collect data.

6. Enter the Secret Access Key for the AWS account.

7. Click Add.

If necessary, you can create multiple accounts, each configured with permissions for all or selected AWS services.

When you have configured at least one account, you can start to configure your data inputs. See Inputs overview for the Splunk App for AWS.