IAM Policy Recommendations for Data Firehose to Splunk via Private Endpoint

Question

I have a test environment in GovCloud (east) using Kinesis/Data Firehose and Splunk Enterprise (on-premise) where I'm trying to send AWS log data to Splunk as a destination. I have Firehose configured to use the http event collector (HEC) as a destination for Splunk and I'm also using a VPC Private Endpoint for the Firehose service. VPC connectivity between the Splunk endpoint and local VPC resources works fine, but I suspect Firehose isn't establishing a connection with the private endpoint and either the IAM policy for the Firehose stream or the VPC endpoint (or both) may be the issue.

AWS documentation is sparse in terms of the minimum IAM policy statements required for both Firehose streams and VPC endpoint. Does anyone have any guidance on how to configure roles/policies for basic functionality in this topology setting?

Sandeep · Answer

Hi 
check these steps to resolve issue Hope it helps You:

IAM Role Permissions: The Firehose delivery stream needs appropriate permissions to access the VPC endpoint and communicate with the HEC endpoint.

VPC Endpoint Policy: The VPC endpoint might have restrictions on inbound traffic, which could prevent Firehose from accessing the Splunk endpoint.

Potential Causes:

* IAM Policy Issues: Firehose might not have the necessary permissions to access the VPC endpoint or perform actions required for HEC communication.
* VPC Endpoint Configuration: The VPC endpoint might not be correctly configured to allow Firehose access.
* Network Connectivity: There might be network issues preventing Firehose from reaching the Splunk endpoint, even within the VPC.

Review IAM Policy for Firehose

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "firehose:PutRecord",
                "firehose:PutRecordBatch",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeNetworkInterfaces"
            ],
            "Resource": "*"
        }
    ]
}

```

Follow the links for more:

* IAM Policies: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html   
* VPC Endpoints: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html   
* Firehose: https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html   
* https://docs.splunk.com/Documentation/AddOns/released/Firehose/ConfigureFirehose

IAM Policy Recommendations for Data Firehose to Splunk via Private Endpoint

Relevant content