AWS Kinesis Firehose fails to connect to Splunk Cloud after enabling it following the correct process

Applicability

Splunk Cloud

Description

Steps in Configure Amazon Kinesis Firehose to send data to the Splunk platform were followed to enable Splunk Cloud HEC specifically for Firehose.

Splunk Add-on for Amazon Kinesis Firehose was installed and HEC endpoint URL https://http-inputs-firehose-<your unique cloud hostname here>.splunkcloud.com:443 is available when checking manually .

Kinesis Firehose still produces the following error:
 

{
"deliveryStreamARN": "arn:aws:firehose:ap-southeast-2:<ACC_NO>:deliverystream/<stream_name>",
"destination": "https://http-inputs-firehose-XXXXX.splunkcloud.com:443",
"deliveryStreamVersionId": 1,
"message": "Failed to deliver data to Splunk or to receive acknowledgment. Make sure HEC 
endpoint is reachable from Firehose and it is healthy.",
"errorCode": "Splunk.MaxRetriesFailed"
}

Investigation

Splunk Cloud default firewall allowlist on HEC port 443 is 0.0.0.0/0 (allow all).

If your stack has a non-default allowlist (For example restricted to certain subnets), you need to explicitly add Kinesis Firehose CIDR block.

Check the next AWS documentation that specifies more information:
Grant Kinesis Data Firehose Access to a Splunk Destination

Note that Kinesis Firehose CIDR blocks depend on the region, there is no need to add the full list, only one line corresponding to the Splunk Cloud stack region.
 

Resolution

Open a case with Splunk Cloud Support and request to add Kinesis Firehose CIDR block to the HEC allowlist citing this knowledge article.
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release