AWS Integration - Logs from CloudWatch error STS: AssumeRole, exceeded maximum number of attempts

Elastic Stack Elastic Agent
1

Hello,

We started seeing the below error on the AWS integrations, precisely for the “Collect Logs from CloudWatch”.

getLogEventsFromCloudWatch failed: error FilterLogEvents with Paginator: operation error CloudWatch Logs: FilterLogEvents, exceeded maximum number of attempts, 3, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, exceeded maximum number of attempts, 3, https response error StatusCode: 0, RequestID: , request send failed, Post "https://sts.us-east-1.amazonaws.com/": dial tcp 10.176.x.x:443: i/o timeout

I am using IAM Role to connect to the AWS account and can confirm I can successfully connect from the CLI. This is only impacting the CloudWatch logs. We we were previously on AWS integration version 2.28.0. We upgraded to the latest 4.7 but it hasn’t resolved the issue.

Any help you can provide will be much appreciated. Thank you

2

Turns out it was an issue with the security group on our VPC endpoint.