Unable to trigger the AWS SNS Alerts from the Splunk Add-on for AWS

Applicability

Description

When a user with "Splunk Power User" capabilities attempts to trigger AWS SNS Alert from the Splunk Add-on for AWS, it did not get triggered and throw an error indicating that "Authorization Failed". 

Investigation

Use below SPL query to see logs for AWS SNS:

index=_internal sourcetype=aws:sns:alert:log

Below is the "Authorization Failed" Error.

2024-09-09 11:12:24,624 level=INFO pid=1058475 tid=MainThread logger=splunk.rest pos=__init__.py:simpleRequest:654 | Authorization Failed: b'<?xml version="1.0" encoding="UTF-8"?>\n<response>\n <messages>\n <msg type="ERROR">You (user=xxxxx) do not have permission to perform this operation (requires capability: list_storage_passwords OR edit_storage_passwords OR admin_all_objects).</msg>\n </messages>\n</response>\n'2024-09-09 11:12:24,624 level=WARNING pid=1058475 tid=MainThread logger=splunk.models.base pos=base.py:iterator:274 | Could not retrieve entities for the given resource with the following error [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/-/Splunk_TA_aws/storage/passwords?search=%22realm%22%3D%22_aws_proxy%22&count=502024-09-09 11:12:25,836 level=ERROR pid=1058475 tid=MainThread logger=splunk_ta_aws.modalerts.sns pos=aws_alert.py:log:95 | | message="Modular Alert - Alert Failed: Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/modalerts/sns/aws_sns_publisher.py", line 40, in get_aws_sns_client
aws_account_cont = aws_accounts[aws_account]
KeyError: 'xxxxxx'

During investigation, it was observed that when a "Splunk Administrator" creates an alert, the alerts gets triggered, and the SNS notification is sent. However, when a user with "Splunk Power User" role creates the alert, alert gets triggered, but the SNS notification is not sent, and user might encounter an error message in the internal logs indicating "Authorization Failed" as mentioned above.

Resolution

To resolve this issue, it is recommended that the user should have "list_storage_passwords" capability be assigned to the "Splunk Power User." Once "list_storage_passwords" capabilities are assigned to the "Splunk power User" then an AWS SNS alert should be triggered.