Splunk Add-on for Amazon Web Services (AWS) Not Populating AWS Secret Regions (IL6 Region)

Applicability

Description

The Splunk Add-on for Amazon Web Services (AWS) enables the collection of data from Amazon Web Services. 

However, users attempting to configure the add-on for Amazon Web Services with regions within the IL6 classification may encounter issues where the Amazon Web Services Secret regions do not populate in the input configuration page.

This limitation occurs because the Splunk Add-on for Amazon Web Services (AWS) does not currently support IL6 regions.

Currently, the Splunk Add-on for Amazon Web Services (AWS) supports only the following regions:

• Global
• GovCloud
• China

Investigation

Upon investigating this behavior, it was confirmed that the Splunk Add-on for Amazon Web Services (AWS) does not support the IL6 region for the population of Amazon Web Services Secrets.

The add-on is designed to work with specific regions (i.e., Global, GovCloud, China).

From endpoint.json file:

"dnsSuffix" : "amazonaws.com",
"partition" : "aws",
"partitionName" : "AWS Standard",
"regionRegex" : "^(us|eu|ap|sa|ca)\\-\\w+\\-\\d+$","dnsSuffix" : "amazonaws.com",
"partition" : "aws-us-gov",
"partitionName" : "AWS GovCloud (US)",
"regionRegex" : "^us\\-gov\\-\\w+\\-\\d+$",
"dnsSuffix" : "amazonaws.com.cn",
"partition" : "aws-cn",
"partitionName" : "AWS China",
"regionRegex" : "^cn\\-\\w+\\-\\d+$",

Resolution

As per the official documentation, it is advised to utilize the supported regions (Global, GovCloud, and China) when configuring the Amazon Web Services Add-on.

The Splunk Add-on for AWS does not support AWS Secret regions in IL6

Related Links

Ideas Portal : Splunk Add-on for AWS Secret Region Compatibility