0

I have an access policy that looks something like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-east-1:123456789012:domain/es01-vpc01-prod-useast1/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "123.456.123.456"
          ]
        }
      }
    }
  ]
}

From my understanding, this should give all es related permissions to anyone at the IP 123.456.123.456. This indeed works for most things: I can access ElasticSearch, and I can also execute CLI commands such as aws es describe-elasticsearch-domain --domain-name es01-vpc01-prod-useast1

However, for some reason I cannot modify the access policy from the CLI using a command like this:

aws es update-elasticsearch-domain-config --domain-name es01-vpc01-prod-useast1 --access-policies '{\"Version\": \"2012-10-17\",\"Statement\": [{\"Effect\": \"Allow\",\"Principal\": {\"AWS\": \"*\"},\"Action\": \"es:*\",\"Resource\": \"arn:aws:es:us-east-1:123456789012:domain/es01-vpc01-prod-useast1/*\",\"Condition\": {\"IpAddress\": {\"aws:SourceIp\": [\"123.456.123.456\"]}}}]}'

I receive an error such as:

An error occurred (AccessDeniedException) when calling the UpdateElasticsearchDomainConfig operation: User: arn:aws:iam::123456789012:user/MyUser is not authorized to perform: es:UpdateElasticsearchDomainConfig on resource: arn:aws:es:us-east-1:123456789012:domain/es01-vpc01-prod-useast1

I have tried variations on the access policy, such as adding the specific role to the access policy, e.g.

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789012:role/MyRole"
  },
  "Action": [
    "es:UpdateElasticsearchDomainConfig"
  ],
  "Resource": "arn:aws:es:us-east-1:123456789012:domain/es01-vpc01-prod-useast1"
}

But still no success. What is the trick to make this work?

  • have you find a solution for this – Shibon Mar 7 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.