# Cisco Umbrella got errors when it called GetBucketLocation

**URL:** <https://discuss.elastic.co/t/cisco-umbrella-got-errors-when-it-called-getbucketlocation/353899>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 22, 2024, 4:40pm UTC](https://discuss.elastic.co/t/cisco-umbrella-got-errors-when-it-called-getbucketlocation/353899 "2024-02-22T16:40:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jian\_Zhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jian_zhang/32/125972_2.png) [@Jian\_Zhang](https://discuss.elastic.co/u/Jian_Zhang)\
**Post date:** [February 22, 2024, 4:40pm UTC](https://discuss.elastic.co/t/cisco-umbrella-got-errors-when-it-called-getbucketlocation/353899/1 "2024-02-22T16:40:24Z")

</div>

Some of the Cisco Umbrella integrations got an error when they called 'GetBucketLocation' at this line: [beats/x-pack/filebeat/input/awss3/input.go at 8ea54119e556fe9de613b7f15a14dbfdd2f31f84 · elastic/beats · GitHub](https://github.com/elastic/beats/blob/8ea54119e556fe9de613b7f15a14dbfdd2f31f84/x-pack/filebeat/input/awss3/input.go#L267)

```auto
[elastic_agent.filebeat][error] Input 'aws-s3' failed with: failed to initialize s3 poller: failed to get AWS region for bucket: operation error S3: GetBucketLocation, exceeded maximum number of attempts, 3, https response error StatusCode: 0, RequestID: , HostID: , request send failed, Get "//cisco-managed-us-east-2./amazonaws.com/cisco-managed-us-east-2?location=": unsupported protocol scheme ""

```

Someone said 'us-east-1' is more reliable, but the source code does not make sense to me that bucket name with other region would break. This issue has not been seen yet in other integrations with S3.

Did anyone have similar issues before?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 22, 2024, 5:48pm UTC](https://discuss.elastic.co/t/cisco-umbrella-got-errors-when-it-called-getbucketlocation/353899/2 "2024-02-22T17:48:28Z")

</div>

> //cisco-managed-us-east-2./amazonaws.com/cisco-managed-us-east-2?location=

This seems to be wrong, how does your configuration looks like in the integration?

---

<div class="post-metadata">

**Author:** ![Jian\_Zhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jian_zhang/32/125972_2.png) [@Jian\_Zhang](https://discuss.elastic.co/u/Jian_Zhang)\
**Post date:** [February 22, 2024, 5:55pm UTC](https://discuss.elastic.co/t/cisco-umbrella-got-errors-when-it-called-getbucketlocation/353899/4 "2024-02-22T17:55:53Z")

</div>

Thanks for the reply. Nothing particular in those failed integrations:

```auto
Bucket ARN: arn:aws:s3:::cisco-managed-us-east-2
Bucket Region: 'us-east-2'
Bucket List Prefix: <just a string>
Number of Workers: 1
Endpoint: amazonaws.com

```

Other optional inputs are blank. I don't see anything different from the configs that work. Access key ID and secret key look correct. Is it possible that the secret key is expired?

---

<div class="post-metadata">

**Author:** ![Jian\_Zhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jian_zhang/32/125972_2.png) [@Jian\_Zhang](https://discuss.elastic.co/u/Jian_Zhang)\
**Post date:** [March 1, 2024, 9:52pm UTC](https://discuss.elastic.co/t/cisco-umbrella-got-errors-when-it-called-getbucketlocation/353899/5 "2024-03-01T21:52:10Z")

</div>

Bump. I've got 4 cisco umbrella integrations that hit the same error, but their configurations are not different from any other successful configurations. Any thoughts?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2024, 11:52pm UTC](https://discuss.elastic.co/t/cisco-umbrella-got-errors-when-it-called-getbucketlocation/353899/6 "2024-03-29T23:52:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.