AWS Inspector v2 input not pulling IAM user account details logs from some account in Splunk addon for AWS.

Applicability

Description

The user has set up a total of 537 accounts through the configuration section, but they are receiving data from only 111 of these accounts.

Investigation

Checked the total account configuration under the IAM role and total number of accounts from where User is pulling data into Splunk using the following SPL query:

index=<> sourcetype=<> | stats count by awsAccountId

Checked the internal logs using the below SPL:

index=_internal datainput=b'<datainputname>'

Error:

2024-03-05 00:26:51,563 level=ERROR pid=1205489 tid=Thread-6 logger=splunk_ta_aws.modinputs.inspector_v2.aws_inspector_v2_data_loader pos=aws_inspector_v2_data_loader.py:_get_findings:109 | | message="Failed to collect data, Exception: An error occurred (AccessDeniedException) when calling the ListFindings operation: User: arn:aws:sts::186572554010:assumed-role/Splunk/splunk_ta_aws is not authorized to perform: inspector2:ListFindings on resource: arn:aws:inspector2:us-west-2:186572554010:/findings/list"
2024-03-05 00:26:51,563 level=ERROR pid=1205489 tid=Thread-6 logger=splunk_ta_aws.modinputs.inspector_v2.aws_inspector_v2_data_loader pos=aws_inspector_v2_data_loader.py:_get_findings:114 | | message="Failed to collect inspector v2 findings for region=us-west-2, region might be disabled in the AWS console"

From the above investigation, it appears that the accounts not pulling data into Splunk may have Inspector logs from a different region, or the accounts may be disabled in a particular region, or they may not have proper permissions.

NOTE: Screenshot attached in this article is taken from the testing environment.

Resolution

The issue was resolved by adding all regions in the input configuration for Inspector v2. Please refer to the screenshot attached below: