EDR: Event Forwarder Does not Connect to External S3 Bucket

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Error message is encountered in /var/log/cb/integrations/cb-event-forwarder/cb-event-forwarder.log: 

time="2020-09-15T11:35:02-04:00" level=info msg="Could not open bucket edrforward: NoCredentialProviders: no valid providers in chain. Deprecated.\n\tFor verbose messaging see aws.Config.CredentialsChainVerboseErrors"

 

Environment

• EDR: 7.1.x +
• EDR Event Forwarder: 3.1.x +

Cause

• Credential Profile name is not setup within the UI.
• AWS Credential ini file will also need to be updated with the appropriate profile name and format.

Resolution

• Add a credential profile name in the EDR Event Forwarder UI:
  • 
• Update AWS Credential ini file to reflect the credential profile name:
  • 
• The AWS Credential ini file will need to be uploaded using the button below:
  •