Filebeat 403 error to SQS

Elastic Stack Beats
1

Following the document from elastic blog, S3 log to Elastic using filebeat and SQS, i keep getting error
2021-04-03T13:45:04.022Z ERROR [input.aws-s3] awss3/collector.go:101 SQS ReceiveMessageRequest failed: AccessDenied: Access to the resource https://sqs.us-east-1.amazonaws.com/ is denied.

`status code: 403, request id: 4d205118-6b7e-545d-96f0-09fa18e103cd {"queue_url": "https://sqs.us-east-1.amazonaws.com/12345678901/log-queue-dev", "region": "us-east-1"}`

ANy suggestion what policy is missing in the doc(blog)

2

Sorry the blog post is not up-to-date. Could you try adding these permissions please? AWS S3 input | Filebeat Reference [7.12] | Elastic

3

I did try adding the permission yet see the 403 error. Any other debug command i can put on filebeat to verify what it is missing.

@Kaiyan_Sheng
thanks for pointing out the permission, added them.

4

i was able to resolve it. It was AWS KMS issue.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.