# Logstash 6.8 role\_arn error

**URL:** <https://discuss.elastic.co/t/logstash-6-8-role-arn-error/235177>\
**Category:** Logstash\
**Created:** [June 1, 2020, 1:51pm UTC](https://discuss.elastic.co/t/logstash-6-8-role-arn-error/235177 "2020-06-01T13:51:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [June 1, 2020, 1:51pm UTC](https://discuss.elastic.co/t/logstash-6-8-role-arn-error/235177/1 "2020-06-01T13:51:34Z")

</div>

Hello,

I was hoping that someone could help me figure this one out.

Basically what it is that I am trying to do in AWS is:

Account 1 (logstash instance with role 1 attached)  
Account 2 (contains the s3 with role 2 created with the policies to ListBucket and GetObject)

Account role 1 is to assume Account role 2. This is to ingest logs from Account 2 S3 bucket to Account 1 logstash instance.

My logstash input.conf as shown below 🙂

```auto
input {
  s3 {
    bucket => "bucket_name"
    region => "eu-west-1"
    proxy_uri => "http://x.x.x.x:3128"
    delete => false
    interval => 300 # seconds
    prefix => "AWSLogs/"
    add_field => { "service" => "cloudtrail" }
    codec => "cloudtrail"
    role_arn => "account2_role_arn"
    tags => ['cloudtrail', 'aws']
    sincedb_path => "/srv/log/sincedb/.testsincedb"
    temporary_directory => "/srv/log/cloudtrail/temp"
  }
}

```

However, logstash logs keeps giving me the error:

```auto
[logstash.pipeline] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<Seahorse::Client::NetworkingError: execution expired>, :backtrace=>["org/jruby/ext/socket/RubyTCPSocket.java:119:in `initialize'", "org/jruby/RubyIO.java:1155:in `open'", "uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/net/http.rb:941:in `block in connect'", "org/jruby/ext/timeout/Timeout.java:99:in `timeout'", "org/jruby/ext/timeout/Timeout.java:75:in `timeout'", "uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/net/http.rb:939:in `connect'", "uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/net/http.rb:924:in `do_start'", "uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/net/http.rb:919:in `start'", "uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/delegate.rb:83:in `method_missing'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/aws-sdk-core-2.11.517/lib/seahorse/client/net_http/connection_pool.rb:285:in `start_session'", 

```

I tested the IAM role cross account on the logstash instance using awscli commands and that works with the below where I am able to list and download the bucket contents of the Account 2 S3 onto Account 1 logstash instance itself :

```auto
aws s3 ls s3://bucket_name

```

and

```auto
aws s3 cp s3://bucket_name/path_to_contents ./test.json

```

So from the 2 awscli above results, this shows that it is nothing to do with security groups and ACLs between the 2 accounts. Nor has nothing to do with the policies set on the IAM roles.

I have done some more research and came across other posts mentioning not to specify the role\_arn in the s3 input.conf file as I have done above. But doing that gives me the error:

```auto
Unable to list objects in bucket {:exception=>Aws::S3::Errors::AccessDenied, :message=>"Access Denied",

```

This works okay using IAM user with access\_key and secret\_key\_id but do not want to keep rotating aws keys every 90 days for many accounts as it is tidious.

Really stuck on this one and help would be much appreciated. Thank you.

---

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [June 2, 2020, 7:26am UTC](https://discuss.elastic.co/t/logstash-6-8-role-arn-error/235177/2 "2020-06-02T07:26:02Z")

</div>

So seems like i may have resolved the issue after all after all.

For what ever reason the s3 input plugin is not actively using the uri\_proxy attribute so what I did was to add the proxy settings to the jvm.options file in /etc/logstash

```auto
-Dhttp.proxyHost=x.x.x.x
-Dhttp.proxyPort=xxxx

```

Restarted logstash service and all WORKED!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2020, 7:26am UTC](https://discuss.elastic.co/t/logstash-6-8-role-arn-error/235177/3 "2020-06-30T07:26:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.