Filebeat agents configured to read from AWS inputs may return an error similar to the following:
sqs ReceiveMessage failed: operation error SQS: ReceiveMessage, https response error StatusCode: 403, RequestID: cb57783a-505f-5099-9160-23b8eea8ddbb, api error SignatureDoesNotMatch: Credential should be scoped to a valid region.
This error was introduced by a breaking change in the AWS library.
This issue also affects FIPS-enabled endpoints. If you rely on FIPS, do not upgrade until version 8.4.2 of the Elastic Stack is available. The workaround documented here will not resolve this problem.
Suggested resolution: In the Filebeat configuration, if an AWS input or module
endpoint to a non empty string, set it to an empty string
instead. Also make sure the default AWS region is set in an environment
variable, credentials or instance profile, or in the
default_region setting in
the configuration. For example:
Or for modules:
Intro to Kibana
ELK for Logs & Metrics