AWS Elastic search change policy using lambda function

Question

I am trying to change the elastic search access policy through lambda function using node js currently access policy looks like bellow

{
  "Version": "2012-10-17",
  "Statement": [
  {
   "Effect": "Allow",
   "Principal": {
     "AWS": "*"
   },
   "Action": "es:*",
   "Resource": "arn:aws:es:us-east-1:XXXX:domain/YYY/*"
 }
]
}

the code which i have tried in lambda

var params = {
     DomainName: 'YYYY'
};
const es = new AWS.ES();
es.upgradeElasticsearchDomain(params, function(err, data) {
    if (err) console.log(err, err.stack); // an error occurred
    else     console.log(data);           // successful response
});

this always throw error is not authorized to perform: es:UpdateElasticsearchDomainConfig on resource with error code "code": "AccessDeniedException",

in the param i will add AccessPolicies this is same as the policy added in my question but the Effect will be Deny

can you please share the code where you instantiate your es client? (hiding the url, ofc) — Thales Minussi, Mar 07 '19 at 10:15
@ThalesMinussi i have just modified in my question `const es = new AWS.ES();` — Shibon, Mar 07 '19 at 10:18
Check the IAM role your Lambda function is using. You can go to AWS's Lambda console and look for the IAM role it is using. Then go to IAM -> Roles and check whether the role that is attached to your Lambda function has full access to ElasticSearch or not — Thales Minussi, Mar 07 '19 at 10:36
@ThalesMinussi Thanks it works after assign `ESFullAccess` to my role — Shibon, Mar 07 '19 at 11:19

score 1 · Accepted Answer · answered Mar 07 '19 at 11:51

After discussing it further with the OP, it turned out it was the lack of permissions on the IAM role attached to the Lambda function.

For others facing the same issue, make sure to attach ESFullAccess to the Lambda function that is playing with ElasticSearch.

To do so, go to IAM -> Roles and select the role attached to your Lambda function.

Click on attach policies and attach ESFullAccess, like the image below:

AWS Elastic search change policy using lambda function

1 Answers1