Splunk Add-on for AWS: Getting Warning about valid SNS Signature with version 2

Applicability

Description

After configuring the SQS-Based S3 Input in the Splunk Add-on for AWS (v7.8.0), observe that logs are not being ingested into Splunk.

Upon reviewing the internal logs, the following warning message may appear:

"Warning: This message does not have a valid SNS Signature. Invalid signature version 2. Unable to verify signature."

This warning signifies that the SQS-Based S3 Input is unable to verify the signature of the SQS message as it is signed using SignatureVersion2, which is not supported by the Splunk Add-on for AWS.

Currently, the Splunk Add-on for AWS supports only SignatureVersion1, causing incompatibility when messages are signed with SignatureVersion2.

Investigation

To investigate the issue, run the below SPL query to check the internal logs of the data input for warnings: 

index=_internal sourcetype=aws:sqsbaseds3:log datainput=<datainput_name> WARNING

Warning Logs:

2024-12-06 01:47:55,778 level=WARNING pid=2854266 tid=Thread-5 logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=handler.py:_process:438 | datainput="Test_input" start_time=1733464949, message_id="384e49bd-0be7-44c3-9e04-d92aa887ebb2" created=1733467675.7774758 expires=1733467975.777522 job_id=54148fa6-4df7-4186-8feb-29fe8506b257 | message="Warning: This message does not have a valid SNS Signature Invalid signature version 2. Unable to verify signature."

The warning indicates that the SQS-based S3 Input cannot verify the signature of the SQS message because it uses SignatureVersion2.

AWS SNS uses cryptographic signing to ensure the legitimacy of messages. This involves signing the message with a private key and verifying it using the corresponding public key. There are different signature versions (V1 and V2), and each uses different algorithms and processes. When a message is received, the system checks the signature against the public key of the sender. If the signature is valid, the message is considered legitimate. This step is crucial for ensuring the integrity and authenticity of the data, preventing unauthorized or tampered messages from being processed.

The Splunk Add-on for AWS currently does not support SignatureVersion2 and allows the ingestion of SQS messages only with SignatureVersion1.

Resolution

To address the issue, update the SignatureVersion in AWS account settings:

- Change the message-signing version from SignatureVersion2 to SignatureVersion1.

This change ensures that messages are signed using the supported version, allowing seamless ingestion into Splunk.

Related Links

AWS Documentation : Verifying Signatures of Amazon SNS messages.

AWS Add-on Input configuration : SQS Based S3 Input