The short version: a Splunk search head, outbound HTTPS from it to the AWS service endpoints, and one read-only IAM identity per AWS account. The details below are the full picture.
Splunk
| Splunk Enterprise | 9.4, 10.0, 10.2, and 10.4 (tested) |
| Splunk Cloud | Supported; during the beta the package installs as a private app - see Splunk Cloud for what is different there |
| Install location | Search head only |
| Search head clustering | Supported, with a paid license |
There is no indexer or forwarder component, and the app writes nothing to an index. It installs on search heads alone, and its whole bin/ directory is excluded from the knowledge bundle, so indexers never receive it.
Search head platform
The bundled binary ships for these search-head operating systems and architectures:
- Linux: amd64, arm64
- Windows: amd64
- macOS: amd64, arm64
AWS
| Partition | Commercial (aws). GovCloud and China regions are not supported in this release. |
| Identity | One IAM identity per account: long-lived access keys, a role to assume, or the search head’s instance role |
| Permissions | Read-only, plus write access to Athena’s result bucket if you use | awsathena. The exact policy is in Accounts - IAM policy; beside the AWS-managed ReadOnlyAccess policy, keep the four actions that run a query - Athena’s StartQueryExecution and StopQueryExecution, and Logs Insights’ StartQuery and StopQuery, which current ReadOnlyAccess already includes - and the Athena result-bucket statements, as the About page’s policy does |
| Cost Explorer | Must be enabled in the account before | awscost and the Cost dashboards return data |
The app talks to the public AWS APIs: Cloud Control, CloudTrail, CloudWatch and CloudWatch Logs, Cost Explorer, Athena, Glue, Resource Groups Tagging, and STS for assumed roles. Every resource type that Cloud Control can list works with | awsget, including types AWS adds after this release.
Network
Outbound HTTPS (port 443) from the search head to the AWS service endpoints in the regions you query - for example cloudcontrolapi.us-east-1.amazonaws.com, logs.us-east-1.amazonaws.com, monitoring.us-east-1.amazonaws.com, athena.us-east-1.amazonaws.com, and the global ce.us-east-1.amazonaws.com for Cost Explorer. The search head is what connects to AWS, so firewall rules and proxies apply there, not on indexers or forwarders.
If your search heads reach AWS through a single egress proxy, or through VPC or FIPS endpoints, point the account at it with its endpoint override (see Accounts).
Credentials
One credential per account, kept in Splunk’s encrypted credential store (storage/passwords), never in a plain configuration file. Static keys work on every tier; cross-account assume-role is a paid feature; the instance role is for self-managed search heads on EC2, where the app reads the instance profile - it does not read an ECS task role or an EKS service-account role. See Accounts for each one.
Licensing
The free tier needs no key: one account on a single standalone search head, with static keys or the instance role. Multiple accounts, search head clustering, per-user credentials, and cross-account assume-role require a paid license. See Licensing.