cant define repository - aws s3

[Moshe Shvo]

Hi All,

 

I have upgraded the system from 3.7 to 3.9

the s3 repository that i had in the snapshot management has disappeared and i cant define a new one , I am getting this error

 

i can see the s3 plugin in the list (also try to reinstall it)

/usr/share/wazuh-indexer/bin/opensearch-plugin install repository-s3

 

any idea how to fix this

{"error":{"root_cause":[{"type":"s3_exception","reason":"s3_exception: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint. (Service: S3, Status Code: 301, Request ID: Q4HDXGG29XX7DCAF, Extended Request ID: lr1MSsJvzzvzj3vHtqkKe8dDEtpBce91MiKu7hV/uroIwTPcqJhZ221IqrJDr4FG7XaQsokYDQXU2FWWRchjFw==)"}],"type":"repository_exception","reason":"[drem-s3] Unexpected exception when loading repository data","caused_by":{"type":"s3_exception","reason":"s3_exception: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint. (Service: S3, Status Code: 301, Request ID: Q4HDXGG29XX7DCAF, Extended Request ID: lr1MSsJvzzvzj3vHtqkKe8dDEtpBce91MiKu7hV/uroIwTPcqJhZ221IqrJDr4FG7XaQsokYDQXU2FWWRchjFw==)"}},"status":500}

 

[Aditya Sharma]

Hi Team,

Can you please install the repository-s3 plugin again, if possible restart the Indexer node and dashboard and try again.

To install the plugin you need to run the following command:

/usr/share/wazuh-indexer/opensearch-plugin install repository-s3

Here are the full instructions on how to register the s3-repository on the current version.

These are Opensearch generic instructions so, the indices names are generic examples.

You may also create the repository from the Dev-Tools section on your Dashboard menu.

Have in mind that this Snapshot scheduling section on Dashboard takes a snapshot of all the indices every day (which can consume a lot of space), so it may not work as expected (just taking the previous day’s index snapshot). To workaround this you may create a cron job on the Indexer node to run an API call to take the previous day’s snapshot (which is closed and complete).

For example, the API call for this may be:

curl -X PUT "https://<WAZUH_INDEXER_IP>:9200/_snapshot/my-s3-repository/wazuh-alerts-4.x-$(date +%Y-%m-%d -d yesterday)-backup" -u <username>:<password> -k -H 'Content-Type: application/json' -d' { "indices": "wazuh-alerts-4.x-$(date +%Y-%m-%d -d yesterday)", "ignore_unavailable": true, "include_global_state": false, "partial": false } '

I hope this helps you.

[Moshe Shvo]

thanks for your answer

already did this on all 3 wazuh nodes

still got this error

{"error":{"root_cause":[{"type":"s3_exception","reason":"s3_exception: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint. (Service: S3, Status Code: 301, Request ID: JR1K6W1T7AKHK87B, Extended Request ID: XnknlTwrXFjOgQbKUX0LfAqkGCUR5Oux3T6dbu9pAa7BKJ7Zk4CxtpDLKfc3iiTxHdjlaUcBTGQV28qit4wPEvwsMTUC/rAouTJdGHcoVyw=)"}],"type":"repository_exception","reason":"[drem-s3] Unexpected exception when loading repository data","caused_by":{"type":"s3_exception","reason":"s3_exception: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint. (Service: S3, Status Code: 301, Request ID: JR1K6W1T7AKHK87B, Extended Request ID: XnknlTwrXFjOgQbKUX0LfAqkGCUR5Oux3T6dbu9pAa7BKJ7Zk4CxtpDLKfc3iiTxHdjlaUcBTGQV28qit4wPEvwsMTUC/rAouTJdGHcoVyw=)"}},"status":500}

[Moshe Shvo]

thanks for your answer

already did this on all 3 wazuh nodes

still got this error

{"error":{"root_cause":[{"type":"s3_exception","reason":"s3_exception: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint. (Service: S3, Status Code: 301, Request ID: JR1K6W1T7AKHK87B, Extended Request ID: XnknlTwrXFjOgQbKUX0LfAqkGCUR5Oux3T6dbu9pAa7BKJ7Zk4CxtpDLKfc3iiTxHdjlaUcBTGQV28qit4wPEvwsMTUC/rAouTJdGHcoVyw=)"}],"type":"repository_exception","reason":"[drem-s3] Unexpected exception when loading repository data","caused_by":{"type":"s3_exception","reason":"s3_exception: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint. (Service: S3, Status Code: 301, Request ID: JR1K6W1T7AKHK87B, Extended Request ID: XnknlTwrXFjOgQbKUX0LfAqkGCUR5Oux3T6dbu9pAa7BKJ7Zk4CxtpDLKfc3iiTxHdjlaUcBTGQV28qit4wPEvwsMTUC/rAouTJdGHcoVyw=)"}},"status":500}

On Tuesday, November 19, 2024 at 10:13:36 AM UTC+2 Aditya Sharma wrote:

[Aditya Sharma]

Hi Team,

It seems likely that this bucket was created in a different region, IE not us-west-2. That's the only time I've seen "The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint."

Please check the region of the AWS bucket once.