Hi All!
I have recently deployed fleet via their terraform deploy, including the addon firehose module. I have dug around the fleet and Osquery docs and am floundering a bit in identifying what command-lines/config options I need to supply to properly route the logs to the deployed firehose infrastructure. I get the feeling I am missing some configuration on the AWS side of things as the docs seem to indicate the need for a configured ID/Key pair, and possibly setting up an additional Kinesis stream.
I would like to be able to set this up with as minimal permissions as required to get the data into Firehose and was assuming STS was the way to go.
My current "Agent Options" in fleet: