Configure a service account for ingestion separation

Set up a Kubernetes service account for ingestion separation resources.

Create and configure a Kubernetes service account with the minimum required permissions for ingestion and indexing resources to perform SQS and S3 operations. With this service account, Splunk uses the correct credentials to perform its tasks.

  1. Create a service account with the required IAM policies using eksctl.

    The following example configures the ingestor-sa service account for the cluster in region us-west-2 with AmazonS3FullAccess and AmazonSQSFullAccess access policies:

    CODE 
    eksctl create iamserviceaccount \
  --name ingestor-sa \
  --cluster ind-ing-sep-demo \
  --region us-west-2 \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonSQSFullAccess \
  --approve \
  --override-existing-serviceaccounts
  2. Verify that the service account exists.
    CODE 
    kubectl describe sa ingestor-sa

    Expected output:

    CODE 
    Name:                ingestor-sa
Namespace:           default
Labels:              app.kubernetes.io/managed-by=eksctl
Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::111111111111:role/eksctl-ind-ing-sep-demo-addon-iamserviceac-Role1-123456789123
Image pull secrets:  <none>
Mountable secrets:   <none>
Tokens:              <none>
Events:              <none>
  3. Verify the IAM role and attached policies.
    CODE 
    aws iam get-role --role-name eksctl-ind-ing-sep-demo-addon-iamserviceac-Role1-123456789123
    CODE 
    aws iam list-attached-role-policies --role-name eksctl-cluster-name-addon-iamserviceac-Role1-123456789123

    Expected output shows AmazonSQSFullAccess and AmazonS3FullAccess policies attached.

You have configured the service account with the required IAM policies for SQS and S3 operations. For more information, see IAM Roles for Service Accounts on eksctl Docs.