Splunk Add-on for AWS: Configuring an AWS IAM Policy to bring logs from Amazon Web Services more securely. (Splunk Cloud)

Applicability

Description

The Splunk Add-on for AWS enables data collection from AWS services such as CloudTrail, CloudWatch Generic S3 etc. To enhance security, an IAM policy can be configured to grant access only when API calls originate from Splunk Cloud's network.

Splunk also makes some API calls using its private IP to AWS, as this is a cost-efficient approach. This can’t be done by simply adding the Private IP of the Splunk Instance where AWS Add-ons inputs are configured as the IAM Policy wouldn’t get saved after adding any Private IP.

IAM supports restricting API access based on SourceVpc & VpcSourceIp and , ensuring that only trusted Splunk instances can interact with AWS resources.

Investigation

1. Identify the Splunk instance making API calls to AWS by checking the input configuration under the AWS Add-on.

2. Obtain the SourceVpc & VpcSourceIp of the associated Splunk instance which are making API calls.

3. Ensure that no other conflicting IAM policies or network ACLs are blocking API requests from Splunk Cloud.

4. Apply the updated policy to the AWS IAM User used by the Splunk Add-on for AWS.

Sample IAM Policy:

The following IAM policy restricts access to API calls based on Splunk’s Private IP and Source VPC:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "RestrictActionsBasedOnVpcAndIp",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "IpAddress": {
                    "aws:VpcSourceIp": [
                        "<Private_IP_Addr>/32"
                    ]
                },
                "StringEquals": {
                    "aws:SourceVpc": "<VPC_ID>"
                }
            }
        }
    ]
}

Resolution

To resolve access issues and implement security controls effectively:

1. Update IAM Policy: Modify the IAM role used by the Splunk Add-on to include the Private IP and Source VPC as added above.

2. Apply the Policy: Attach the updated policy to the IAM User in AWS.

3. Validate API Calls: Test connectivity by running queries in Splunk and verifying if data ingestion occurs as expected.

Note: 

The provided policy grants complete access to Splunk. It is advisable to review the policy with the AWS team and update it accordingly based on the specific use case as per the inputs configured to adhere to the principle of least privilege.

Since these details (Private IP and Source VPC) vary based on the specific Splunk Cloud deployment, they are not publicly available. To obtain the necessary Vpc and Private IP details, please contact Splunk Support.