The AWS Cross-Account Access Identity can be configured to optionally require the IAM account to provide an agreed value called external_id to enable AWS Audit logs to identify which IAM user account is using an AssumedRole for Cross Account access.
This requires the AWS AssumeRoleCredentials to provide in addition to Cliet, Role ARN, Role Seesion Name the external_ID. Without it the IAM cannot successfully authenticate.
Additionally, the current 4.3.0 version assumes that Logstash is running on a ec2 instance if assume Role is going to be used. Assume role will not work on a non ec2 VM.
The AWS Cross-Account Access Identity can be configured to optionally require the IAM account to provide an agreed value called external_id to enable AWS Audit logs to identify which IAM user account is using an AssumedRole for Cross Account access.
This requires the AWS AssumeRoleCredentials to provide in addition to Cliet, Role ARN, Role Seesion Name the external_ID. Without it the IAM cannot successfully authenticate.
Additionally, the current 4.3.0 version assumes that Logstash is running on a ec2 instance if assume Role is going to be used. Assume role will not work on a non ec2 VM.