search

splunk / splunk-aws-project-trumpet

MIT License
95 stars 31 forks source link

Template fails to deploy with Error occurred while GetObject. S3 Error Code: NoSuchKey. S3 Error Message: The specified key does not exist. #22

Open ylukin opened 4 years ago

ylukin commented 4 years ago

I tried deploying the template in us-east-1, us-east-2, us-west-2 and eu-west-1. Kept getting the following in CloudFormation:

The following resource(s) failed to create: [LambdaHecAutomation]. . Rollback requested by user.

Error occurred while GetObject. S3 Error Code: NoSuchKey. S3 Error Message: The specified key does not exist. (Service: AWSLambdaInternal; Status Code: 400; Error Code: InvalidParameterValueException;
AlDawoode commented 3 years ago

No body answer us, so it will be good to answer each other. I may help you to solve your problem >>>>

When we run the CW-trumpet-template so the template require files that saved in some S3 bucket , it seems like that not all bucket exist any more. But here the solution:

You have to check what the Trumpet template required files is ... then download the files locally ... then upload the required files to your own S3 bucket in any region your prefer ....

at the end you have to remove the code below from CW-trumpet-template :

Mappings: BucketMap: us-east-1: BucketName: trumpet-splunk-prod-us-east-1 us-east-2: BucketName: trumpet-splunk-prod-us-east-2 us-west-1: BucketName: trumpet-splunk-prod-us-west-1 us-west-2: BucketName: trumpet-splunk-prod-us-west-2 ca-central-1: BucketName: trumpet-splunk-prod-ca-central-1 eu-central-1: BucketName: trumpet-splunk-prod-eu-central-1 eu-west-1: BucketName: trumpet-splunk-prod-eu-west-1 eu-west-2: BucketName: trumpet-splunk-prod-eu-west-2 eu-west-3: BucketName: trumpet-splunk-prod-eu-west-3 ap-northeast-1: BucketName: trumpet-splunk-prod-ap-northeast-1 ap-northeast-2: BucketName: trumpet-splunk-prod-ap-northeast-2 ap-southeast-1: BucketName: trumpet-splunk-prod-ap-southeast-1 ap-southeast-2: BucketName: trumpet-splunk-prod-ap-southeast-2 ap-south-1: BucketName: trumpet-splunk-prod-ap-south-1 sa-east-1: BucketName: trumpet-splunk-prod-sa-east-1

And add thee code below instead :

Mappings: BucketMap: your-region-where-your-s3-bucket-saved: BucketName: your-bucket-name

I faced the same problem before and solve it my self.

anushjay commented 3 years ago

Hi @ylukin The up-to-date lambda functions for CWL, CWE and VPC and its older versions (eg: splunk_cwl_firehose_processor_v0.3.zip) should be available in the respective S3 bucket regions. And when CF is run in a specific region uses bucket mappings to pick up the right functions. What lambda function are you trying to use?