1

I want to create an AWS Elasticsearch with this policy, to enable specific access from IAM roles, set admin IPs, and public read only. ES Console keeps returning an error "Error setting policy". I can't work out why this would not be allowed?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<id>:role/<lambda role 1 name>"
      },
      "Action": "es:ESHttpPost",
      "Resource": "arn:aws:es:eu-west-1:<id>:domain/*/*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<id>:role/<lambda role 2 name>"
      },
      "Action": "es:ESHttpDelete",
      "Resource": "arn:aws:es:eu-west-1:<id>:domain/*/*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:eu-west-1:<id>:domain/*/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "<ip1>",
            "<ip2>",
            "<ip3>"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:ESHttpGet",
      "Resource": "arn:aws:es:eu-west-1:<id>:domain/*/*"
    }
  ]
}

It's in eu-west-1 and version 7.1. I've tried variations like es:* and putting principals in an array (like in the provided templates) but these are all rejected?! I can seemingly only have 2 statements, with 1 principal in each (* and 1 of these IAMs).

Is there a better recommended way? Like putting it behind API Gateway or something. I saw reverse proxy in the docs but this seems like a ridiculous overkill and $$$.

Tobin
  • 1,698
  • 15
  • 24
  • Did you select `VPC access` or `Public access`? You can't specify IP address conditions with the former afaik. – jarmod Sep 10 '19 at 13:17
  • Thanks, good point, but sadly I'm on Public Access. My "solution" is an API Gateway in front of ES. – Tobin Sep 10 '19 at 13:39
  • I was able to create a ES development cluster (Public access) in us-east-1 using your policy (and modified IPs, IAM roles etc). Do you get an error message that includes anything more than "Error setting policy"? – jarmod Sep 10 '19 at 14:07

0 Answers0