Error occurred (InvalidArgument) when calling the PutBucketNotificationConfiguration operation

Error when adding AWS S3 event trigger:

An error occurred (InvalidArgument) when calling the PutBucketNotificationConfiguration operation: Unable to validate the following destination configurations

Solutions:

To avoid an error, you must create resources in the following order:

1. Make sure SNS topic exists, because the S3 bucket references the SNS topic.

2. Make sure the S3 bucket exists, because the SNS topic policy references both the S3 bucket and the SNS topic.

Before subscribing an SNS topic to S3 event notifications, you must specify a topic policy (AWS::SNS::TopicPolicy) with the appropriate permissions. That topic policy must exist before you create the subscription.

{ “Sid”: “Statement-id”, “Effect”: “Allow”, “Principal”: { “AWS”: “*” }, “Action”: “sns:Publish”, “Resource”: { “Ref”: “SNSTopic” }, “Condition”: { “ArnLike”: { “aws:SourceArn”: { “Fn::Join”: [ “”, [ “arn:aws:s3:::”, { “Ref”: “S3Bucket” } ] ] } } } }

Finally check if the subscription to S3 event already exists.

 

 

Error occurred (InvalidArgument) when calling the PutBucketNotificationConfiguration operation

Update maxmind geoip database for iplocation splunk command

If you are using outdated maxmind db in your splunk version, you will see some of the location is not right for a few IPs. Follow these steps to update the maxmind GeoLite2-City db file:

  1. You can go to this site, http://dev.maxmind.com/geoip/geoip2/geolite2/
  2. Download GeoLite2-City.mmdb
  3. Replace it with $SPLUNK_HOME/share/GeoLite2-City.mmdb, usually at /opt/splunk/share in any Linux host
  4. Don’t need to restart splunk, run new query in splunk and the db will be refreshed itself.
Update maxmind geoip database for iplocation splunk command