Configure accounts for the Splunk Add-on for AWS

Configure accounts for the Splunk Add-on for AWS to collect CloudWatch data. Manage your accounts, proxy connections, and log levels for the Splunk Add-on for AWS on your data collection node.

The Splunk Add-on for AWS supports two ways to interact with AWS to collect data:

• Using EC2 (Elastic Compute Cloud) IAM (Identity and Access Management) roles.
• Using AWS user accounts.

Discover an EC2 IAM role

To run a data collection node on your Splunk platform in your own managed AWS environment using commercial regions, set up an IAM role for the EC2, then use that role to configure data collection jobs. The Splunk Add-on for AWS automatically discovers this role once it is set up.

Collecting data using an auto-discovered EC2 IAM role is not supported in the AWS China region.

1. Follow the AWS documentation to set up an IAM role for your EC2: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html.
2. Ensure that this role has adequate permissions. If you do not give this role all of the permissions required for all inputs, configure AWS accounts specific to inputs not covered by the permissions for this role.
3. On the Splunk Web home page, click Splunk Add-on for AWS in the left navigation bar..
4. Click Configuration in the app navigation bar. By default, the add-on displays the Account tab.
5. Look for the EC2 IAM role in the Autodiscovered IAM Role column. If you are in your own managed AWS environment and have an EC2 IAM role configured, it appears in this account list automatically.

You can also configure AWS accounts if you want to use both EC2 IAM roles and user accounts to ingest your AWS data.

You cannot edit or delete EC2 IAM roles from the add-on.

Add and manage AWS accounts

Perform the following steps to add an AWS account:

1. In the Splunk Web home page, click Splunk Add-on for AWS in the left navigation bar.
2. Click Configuration in the app navigation bar. The add-on displays the Account tab.
3. Click Add.
4. Name the AWS account. You cannot change this name once you configure the account.
5. Enter the Key ID and Secret Key credentials for the AWS account that the Splunk platform uses to access your AWS data. The accounts that you configure must have the necessary permissions to access the AWS data that you want to collect.
6. Select the Region Category for the account. The most common category is Global.
7. Click Add.

Edit existing accounts by clicking Edit in the Actions column.

Delete an existing account by clicking Delete in the Actions column. You cannot delete accounts that are associated with any inputs, even if those inputs are disabled. To delete an account, delete the inputs or edit them to use a different account and then delete the account.

To use custom commands and alert actions, you must set up at least one AWS account on your Splunk platform deployment search head or search head cluster.

Add and manage IAM roles

Use the Configuration menu in the Splunk Add-on for AWS to manage AWS IAM roles that can be assumed by IAM users. Adding IAM roles lets the Splunk Add-on for AWS access the following AWS resources:

• Generic S3
• Incremental S3
• SQS-based S3
• Billing
• Description
• Metadata
• CloudWatch
• Kinesis

Add an IAM role

Use the following steps to add an IAM role:

1. On the Splunk Web home page, click Splunk Add-on for AWS in the left navigation bar.
2. Click Configuration in the app navigation bar, and then click the IAM Role tab.
3. Click Add.
4. In the Name field, name the role to be assumed by authorized AWS accounts managed on the Splunk platform. You cannot change the name once you configure the role.
5. In the ARN field, enter the role's Amazon Resource Name in the valid format: arn:aws:iam::<aws_resource_id>:role/<role_name>.
6. Click Add.

Click Edit in the Actions column to edit existing IAM roles.

Click Delete in the Actions column to delete an existing role. You cannot delete roles associated with any inputs, even if those inputs are disabled. To delete an account, delete the inputs or edit them to use a different assumed role and then delete the role.

Configure a proxy connection

1. On the Splunk Web home page, click Splunk Add-on for AWS in the left navigation bar.
2. Click Configuration in the app navigation bar.
3. Click the Proxy tab.
4. Select the Enable box to enable the proxy connection and fill in the fields required for your proxy.
5. Click Save.

To disable your proxy but save your configuration, uncheck the Enable box. The add-on stores your proxy configuration so that you can enable it later.

To delete your proxy configuration, delete the values in the fields.