Configure Config Inputs for the Splunk Add-on for AWS¶
Complete the steps to configure Config inputs for the Splunk Add-on for Amazon Web Services (AWS):
- You must manage accounts for the add-on as a prerequisite. See Manage accounts for the Splunk Add-on for AWS.
- Configure AWS services for the Config input.
- Configure AWS permissions for the Config input.
- Configure Config inputs either through Splunk Web or configuration files.
Configure AWS Services for the CloudWatch Input¶
Best practices¶
- Configure Simple Queue Service (SQS)-based S3 inputs to collect AWS data.
- Configure an AWS Config input for the Splunk Add-on for Amazon Web Services on your data collection node through Splunk Web. This data source is available only in a subset of AWS regions, which does not include China. See the https://docs.aws.amazon.com/general/latest/gr/rande.html for a full list of supported regions.
- Configure a single enabled Config modular input for each unique SQS. Multiple enabled modular inputs can cause conflicts when trying to delete SQS messages or S3 records that another modular input is attempting to access and parse.
- Disable or delete testing configurations before releasing your configuration in production.
Supported Config Input message types¶
The following message types are supported by the Config inputs for the Splunk Add-on for AWS:
ConfigurationHistoryDeliveryCompleted
ConfigurationSnapshotDeliveryCompleted
ConfigurationItemChangeNotification
OversizedConfigurationItemChangeNotification
Configure AWS Config permissions¶
Set the following permissions in your AWS configuration:
AWS Service | Permissions |
---|---|
S3 | GetObject GetBucketLocation ListBucket ListAllMyBuckets |
SQS | GetQueueAttributes ListQueues ReceiveMessage GetQueueUrl SendMessage DeleteMessage |
Config | DeliverConfigSnapshot |
IAM | GetUser |
See the following sample inline policy to configure Config input permissions:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetObject",
"s3:GetBucketLocation",
"s3:ListAllMyBuckets"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"sqs:ListQueues",
"sqs:ReceiveMessage",
"sqs:GetQueueAttributes",
"sqs:SendMessage",
"sqs:GetQueueUrl",
"sqs:DeleteMessage"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"config:DeliverConfigSnapshot"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:GetUser"
],
"Resource": [
"*"
]
}
]
}
For more information and sample policies, see the following AWS documentation:
- For SQS, see https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-authentication-and-access-control.html.
- For S3, see https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-iam.html.
Configure a Config Input using Splunk Web¶
To configure inputs using Splunk Web:
- Click Splunk Add-on for AWS in the navigation bar on Splunk Web home.
- Click Create New Input > Config > Config.
- Fill out the fields as described in the table:
Argument in configuration file | Field in Splunk Web | Description |
---|---|---|
aws_account |
AWS Account | The AWS account or EC2 IAM role the Splunk platform uses to access your Config data. In Splunk Web, select an account from the drop-down list. |
aws_region |
AWS Region | The AWS region that contains the log notification SQS queue. Enter the region ID. https://docs.aws.amazon.com/general/latest/gr/rande.html#d0e371. |
sqs_queue |
SQS queue name | The name of the queue to which AWS sends new Config notifications. Select a queue from the drop-down list, or enter the queue name manually. The queue name is the final segment of the full queue URL. For example, if your SQS queue URL is http://sqs.us-east-1.amazonaws.com/123456789012/testQueue ,then your SQS queue name is testQueue . |
sourcetype |
Source type | A source type for the events. Enter a value only if you want to override the default of aws:config . Event extraction relies on the default value of source type. If you change the default value, you must update props.conf as well. The Splunk platform indexes AWS Config events using three variations of this source type:aws:config .ConfigurationItemChangeNotification and OversizedConfigurationItemChangeNotification , are indexed as sourcetype=aws:config:notification .aws_config.log are indexed as sourcetype=aws:config:log . |
index |
Index | The index name where the Splunk platform puts the Config data. The default is main . |
polling_interval |
Interval | The number of seconds to wait before the Splunk platform runs the command again. The default is 30 seconds. |
Configure a Config Input using Configuration Files¶
Note
Create AWS Config inputs only through the Web interface.
To configure inputs manually in inputs.conf, create a stanza using the
following template and add it to
$SPLUNK_HOME/etc/apps/Splunk_TA_aws/local/inputs.conf
. If the file or
path does not exist, create it.
[aws_config://<name>]
aws_account = <value>
aws_region = <value>
sqs_queue = <value>
interval = <value>
sourcetype = <value>
index = <value>
The following example shows stanza of AWS Config Input:
[aws_config://config_data]
aws_account = splunkapp2
sourcetype = aws:config
aws_region = us-west-2
sqs_queue = aws-sqs-queue
sourcetype = aws:config
index = default
interval = 30