pvirani03/11/2022, 8:00 PM
Kathy Satterlee03/11/2022, 8:21 PM
pvirani03/11/2022, 8:25 PM
This is what I've configured. There doesn't seem to be a way to specify that the RESULT_STREAM is in fact another account
- name: FLEET_OSQUERY_RESULT_LOG_PLUGIN value: "firehose" - name: FLEET_FIREHOSE_REGION value: "us-west-2" - name: FLEET_FIREHOSE_RESULT_STREAM value: "p8t-osquery-stage-logs-es"
but that doesn't work because the entire value just gets appended like so
FLEET_FIREHOSE_RESULT_STREAM value: <ARN of the delivery stream in AccountB>
arn:aws:firehose:<region>:<AccountA>:deliverystream/<ARN of the delivery stream in AccountB>
Kathy Satterlee03/11/2022, 9:38 PM
, so I assumed that was your log destination plugin. Let me dig in to firehose.