Add an AWS Config input for the Splunk App for AWS

Create an AWS Config input to take a snapshot of your AWS Account and gather helpful information about your AWS environment.

Prerequisites

Before you can successfully configure an AWS Config input, you need to:

1. Set up the AWS Config service for all the regions that you want to track data in the Splunk App for AWS. If you have not already done this, see Configure your AWS services for the Splunk App for AWS in this manual.

Note: This data source is only available in a subset of AWS regions, which does not currently include China or GovCloud. See the AWS documentation for a full list of supported regions: http://docs.aws.amazon.com/general/latest/gr/rande.html#awsconfig_region.

2. Make sure that the account friendly name you use to configure this input corresponds to an AWS Account Access Key ID or EC2 IAM role that has the necessary permissions to gather this data. If you have not already done this, see Configure your AWS permissions for the Splunk App for AWS in this manual.

Add a new Config input

1. In the app, click Configure in the app navigation bar.

2. Under Data Sources, in the AWS Config box, click Set Up.

3. Select the friendly name of the AWS Account that you want to use to collect AWS Config data. If you have not yet configured the account you need, click Add New Account to configure one now.

4. Under SQS Configurations, select a Region for which you have enabled AWS Config.

5. Click Select an SQS queue to view the SQS queue names for the region you have selected. If you do not see any, verify that you have completed all steps in the prerequisites. Do not configure multiple Config inputs pulling data from the same SQS queue. Having multiple inputs can cause conflicts when one input tries to delete an SQS message that another input is attempting to access and parse.

6. Select the queue name that is subscribed to the SNS topic for Config notifications for this region.

7. Click the + button to add another region.

8. Repeat steps 4 - 6 until you have configured SQS queues for all the regions where you have Config enabled in AWS.

9. (Recommended) Configure a custom Index.
Note: If you are configuring the app in Splunk Cloud, you still need to configure your own indexes. See Manage Splunk Cloud Platform indexes in the Splunk Cloud Platform Admin Manual for detailed instructions.

10. Click Add to save and enable this data input.

Once saved, the input begins collecting data immediately and checks for updates every 30 seconds.

When you first create the data input, the Splunk App for AWS triggers your AWS Config service to take a snapshot of your AWS environment. If the app is unable to collect a snapshot, one of the following may be true:

• You may have encountered a rate limit on snapshot requests set by AWS. If you see a message that says "You have exceeded the maximum request rate set by AWS. Please try again later." wait a few minutes, then click Retry. If you navigate away from this screen, you can return to the Config Inputs screen at any time and click Take Snapshot to try again.
• You may not have sufficient permissions to take snapshots with the account you chose. See Configure your AWS permissions for the Splunk App for AWS in this manual. You can adjust the permissions as needed and then return to the Config Inputs screen at any time and click Take Snapshot to try again.
• You may be attempting to configure the Config input in a region that does not support the Config service. For example, AWS does not offer the AWS Config service in the China and GovCloud regions at this time.

Edit or delete a Config input

You can view, edit, or delete your existing AWS Config inputs from the Config Inputs screen.

1. In the app, click Configure in the app navigation bar.

2. Under Data Sources, in the AWS Config box, click the link that tells you how many inputs you currently have configured for AWS Config.

3. The Config Inputs screen displays a list of AWS Config inputs, organized by the name auto-assigned to the input.

4. From here, you can click the names to open the individual inputs to edit them, click Take Snapshot to trigger the app to take a snapshot from AWS Config, or delete an input.