Splunk® Enterprise

Add AWS CloudFront access log data: Splunk Cloud

Download manual as PDF

Download topic as PDF

Configure accounts for the Splunk Add-on for AWS

Manage your accounts, proxy connections, and log levels for the Splunk Add-on for AWS on your data collection node.

The Splunk Add-on for AWS supports two ways to interact with AWS to collect data:

  • Using EC2 (Elastic Compute Cloud) IAM (Identity and Access Management) roles.
  • Using AWS user accounts.

Discover an EC2 IAM role

To run a data collection node on your Splunk platform in your own managed AWS environment using commercial regions, set up an IAM role for the EC2, then use that role to configure data collection jobs. The Splunk Add-on for AWS automatically discovers this role once it is set up.

Collecting data using an auto-discovered EC2 IAM role is not supported in the AWS China region.

  1. Follow the AWS documentation to set up an IAM role for your EC2: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html.
  2. Ensure that this role has adequate permissions. If you do not give this role all of the permissions required for all inputs, configure AWS accounts specific to inputs not covered by the permissions for this role.
  3. On the Splunk Web home page, click Splunk Add-on for AWS in the left navigation bar..
  4. Click Configuration in the app navigation bar. By default, the add-on displays the Account tab.
  5. Look for the EC2 IAM role in the Autodiscovered IAM Role column. If you are in your own managed AWS environment and have an EC2 IAM role configured, it appears in this account list automatically.

You can also configure AWS accounts if you want to use both EC2 IAM roles and user accounts to ingest your AWS data.

You cannot edit or delete EC2 IAM roles from the add-on.

Add and manage AWS accounts

Perform the following steps to add an AWS account:

  1. In the Splunk Web home page, click Splunk Add-on for AWS in the left navigation bar.
  2. Click Configuration in the app navigation bar. The add-on displays the Account tab.
  3. Click Add.
  4. Name the AWS account. You cannot change this name once you have configured the account.
  5. Enter the credentials Key ID and Secret Key for the AWS account that the Splunk platform uses to access your AWS data. The accounts that you configure must have the necessary permissions to access the AWS data that you want to collect.
  6. Select the Region Category for the account. The most common category is "Global".
  7. Click Add.

Edit existing accounts by clicking Edit in the Actions column.

Delete an existing account by clicking Delete in the Actions column. You cannot delete accounts that are associated with any inputs, even if those inputs are disabled. To remove an account in this case, delete the inputs or edit them to use a different account and then delete the account.

To use custom commands and alert actions, you must set up at least one AWS account on your Splunk platform deployment search head or search head cluster.

Add and manage IAM roles

Use the Configuration menu in the Splunk Add-on for AWS to manage AWS IAM roles that can be assumed by IAM accounts. This lets the Splunk Add-on for AWS access the following AWS resources:

  • Generic S3
  • Incremental S3
  • SQS-Based S3
  • Billing
  • Description
  • CloudWatch
  • Kinesis

Add an IAM role

Use the following steps to add an IAM Role:

  1. On the Splunk Web home page, click Splunk Add-on for AWS in the left navigation bar.
  2. Click Configuration in the app navigation bar, and then click the IAM Role tab.
  3. Click Add.
  4. In the Name field, name the role to be assumed by authorized AWS accounts managed on the Splunk platform. You cannot change the name once you have configured the role.
  5. In the ARN field, enter the role's Amazon Resource Name in the valid format: arn:aws:iam::<aws_resource_id>:role/<role_name>.
  6. Click Add.

Click Edit in the Actions column to edit existing IAM roles.

Click Delete in the Actions column to delete an existing role. You cannot delete roles associated with any inputs, even if those inputs are disabled. To remove an account in this case, delete the inputs or edit them to use a different assumed role and then delete the role.

Configure a proxy connection

  1. On the Splunk Web home page, click Splunk Add-on for AWS in the left navigation bar.
  2. Click Configuration in the app navigation bar.
  3. Click the Proxy tab.
  4. Select the Enable box to enable the proxy connection and fill in the fields required for your proxy.
  5. Click Save.

To disable your proxy but save your configuration, uncheck the Enable box. The add-on stores your proxy configuration so that you can enable it later.

To delete your proxy configuration, delete the values in the fields.

PREVIOUS
Install the Splunk Add-on for AWS
  NEXT
Configure data collection on your Splunk Enterprise instance

This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.3.0, 7.3.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters