pvirani
03/11/2022, 8:00 PMKathy Satterlee
03/11/2022, 8:21 PMpvirani
03/11/2022, 8:25 PM- name: FLEET_OSQUERY_RESULT_LOG_PLUGIN
value: "firehose"
- name: FLEET_FIREHOSE_REGION
value: "us-west-2"
- name: FLEET_FIREHOSE_RESULT_STREAM
value: "p8t-osquery-stage-logs-es"
This is what I've configured. There doesn't seem to be a way to specify that the RESULT_STREAM is in fact another accountFLEET_FIREHOSE_RESULT_STREAM
value: <ARN of the delivery stream in AccountB>
but that doesn't work because the entire value just gets appended like so
arn:aws:firehose:<region>:<AccountA>:deliverystream/<ARN of the delivery stream in AccountB>
Kathy Satterlee
03/11/2022, 9:38 PMKenesis
, so I assumed that was your log destination plugin. Let me dig in to firehose.firehose_access_key_id
and firehose​_secret​_access​_key
. The details for that are here:
https://fleetdm.com/docs/deploying/configuration#firehose