IAM credentials not being recognised

[Mark Walkom]

This was initially reported in a Discuss thread here.

Config;

input {
        s3 {
                bucket              => "mybucketname-logs-cloudtrail"
                access_key_id       => "ACCESS_KEY_HERE"
                secret_access_key   => "SECRET_KEY_HERE"
                region              => "eu-west-1"
                codec               => "cloudtrail"
                type                => "cloudtrail"
                prefix              => "AWSLogs/AWS_ACCOUNT_ID_HERE/CloudTrail/eu-west-1/2015/09/27"
                temporary_directory => "/tmp/temp-cloudtrail_s3_temp"
                sincedb_path        => "/tmp/temp-cloudtrail_s3_sincedb"
                debug               => "true"
        }
}
output {
        elasticsearch {
                host => "ELASTICSEARCH_URL_HERE"
                protocol => "http"
        }
        stdout {
                codec => "rubydebug"
        }
}

There's some debug logging here as well.

I hope the discuss thread and this gives you a good idea of the situation, but let me know if my summary sucks :)

[Joseph Lawson]

This could be related to the older sdk #25

[Kareem Straker]

@joekiller @markwalkom @ph I originally reported this issue, in the linked thread https://discuss.elastic.co/t/iam-credentials-not-recognised-used-for-s3-plugins-used-input-s3-codec-cloudtrail/32464
It's since been very quiet. Does anyone know anything about this?

[P.]

Has there been any updates on this issue? I have found the same situation, as reported here

[glen-uc]

Any update would be appreciate as i am facing the same issue with logstash:7.13.0

I can't use older image because i am running my workloads on arm machine (only new image supports this architecture)

[Karol Bucek]

this is expected to be fixed since LS 7.12.0, which ships an update from the shared mixin: logstash-plugins/logstash-mixin-aws#50