提供基于IP的访问策略时，无法从我的VPN访问AWS Elasticsearch

Question

I have an Elasticsearch domain in AWS. I have created a IP-based access policy and am trying to provide all my VPN CIDR blocks there so that I can let all the machines in this VPN access Elasticsearch and Kibana and run some curl commands on Elasticsearch domain.

I tried my IP address from ipconfig -> Doesn't work
I tried my IP address from Google (Public IP Adrees) -> Works
I tried my VPN CIDR Blocks => Doesn't work

"Condition": {
    "IpAddress": {
        "aws:SourceIp": "x.x.x.x/16"
    }
}

Answer 1

The IP addresses should be an array

      "Condition": {
        "IpAddress": {"aws:SourceIp": ["youip1/32"]}
      }

and also I am wondering if you missed resouices in the policy

  "Resource": "arn:aws:es:us-west-2:${data.aws_caller_identity.user.account_id}:domain/test/*",

Here is the working example that you can try

# Creating ElasticSearch Domain with Policy
resource "aws_elasticsearch_domain" "test-domain" {
  domain_name           = "testes"
  elasticsearch_version = "6.7"

  cluster_config {
    instance_type  = "t2.small.elasticsearch"
    instance_count = 2

  }

  ebs_options {
    ebs_enabled = true
    volume_size = 10
    volume_type = "standard"
  }

  snapshot_options {
    automated_snapshot_start_hour = 23
  }

  access_policies = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "es:*",
      "Principal": "*",
      "Effect": "Allow",
      "Resource": "arn:aws:es:${var.region}:${data.aws_caller_identity.user.account_id}:domain/testes/*",
      "Condition": {
        "IpAddress": {"aws:SourceIp": ["VPN_public_IP/32", "1.2.3.4/32"]}
      }
    }
  ]
}
POLICY

  tags = {
    Domain = "testes-tag"
  }
}

Also, double-check VPN config, does it route all traffic or specific and verify VPN IP as you verified your local IP from google. Connect with VPN and check you IP add that IP in the policy.