Error Configuring SQS-Based S3 Input Using VPC Private Endpoints in Splunk Add-on for AWS

Applicability

Description

During the setup of an SQS-based S3 data input using VPC Private Endpoints in the AWS TA, the configuration fails with a SignatureDoesNotMatch error.

Investigation

Internal logs captured using the following SPL query reveal the error details:

index=_internal sourcetype=splunkd *Splunk_TA_aws* ERROR

Error log:

04-23-2025 04:12:00.183 +0000 ERROR AdminManagerExternal [11340 TcpChannelThread] - Stack trace from python handler:\nTraceback (most recent call last):\n  File "<string>", line 100, in _list_queues\n  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/common/credentials.py", line 389, in __init__\n    self._credentials = provider.load()\n  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/common/credentials.py", line 348, in load\n    return self._aws_account.load_credentials(\n  File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/common/credentials.py", line 184, in load_credentials\n    identity = sts.get_caller_identity()\n  File "/opt/splunk/etc/apps/Splunk_TA_aws/lib/botocore/client.py", line 535, in _api_call\n    return self._make_api_call(operation_name, kwargs)\n  File "/opt/splunk/etc/apps/Splunk_TA_aws/lib/botocore/client.py", line 983, in _make_api_call\n    raise error_class(parsed_response, operation_name)\nbotocore.exceptions.ClientError: An error occurred (SignatureDoesNotMatch) when calling the GetCallerIdentity operation: Credential should be scoped to a valid region. \n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/opt/splunk/lib/python3.9/site-packages/splunk/admin.py", line 151, in init\n    hand.execute(info)\n  File "/opt/splunk/lib/python3.9/site-packages/splunk/admin.py", line 647, in execute\n    if self.requestedAction == ACTION_LIST:     self.handleList(confInfo)\n  File "<string>", line 46, in handleList\n  File "<string>", line 110, in _list_queues\nsplunktaucclib.rest_handler.error.RestError: REST Error [400]: Bad Request -- An error occurred (SignatureDoesNotMatch) when calling the GetCallerIdentity operation: Credential should be scoped to a valid region. \n

This error occurs during AWS STS (Security Token Service) authentication and is commonly caused by region mismatch between AWS services.

Resolution

Ensure that all AWS resources involved (S3 bucket, SQS queue, and VPC Private Endpoint) are deployed in the same AWS region. This is necessary for successful credential validation and to avoid signature-related errors during configuration.