AWS 权限错误…… Kinesis Firehose 没有向 Elasticsearch 发送数据……

Question

I get this error in CloudWatch logs of kinesis firehose

{
    "deliveryStreamARN": "arn:aws:firehose:us-west-2:917877325894:deliverystream/test_dynamodb",
    "destination": "arn:aws:es:us-west-2:917877325894:domain/test-dynamodb2",
    "deliveryStreamVersionId": 1,
    "message": "Error received from Elasticsearch cluster. {\"error\":{\"root_cause\":[{\"type\":\"security_exception\",\"reason\":\"no permissions for [indices:data/write/bulk] and User [name=arn:aws:iam::917877325894:role/firehose_delivery_role2, backend_roles=[arn:aws:iam::917877325894:role/firehose_delivery_role2], requestedTenant=null]\"}],\"type\":\"security_exception\",\"reason\":\"no permissions for [indices:data/write/bulk] and User [name=arn:aws:iam::917877325894:role/firehose_delivery_role2, backend_roles=[arn:aws:iam::917877325894:role/firehose_delivery_role2], requestedTenant=null]\"},\"status\":403}",
    "errorCode": "ES.ServiceException"
}

I have added all different policies to the role attached to Firehose but still getting the same error.(btw the role was made by firehose itself but I tried also adding more policies with no different result)

I also have open access policy for the elasticsearch domain

Did anyone face the same thing before?

Answer 1

I had the same problem, instructions for troubleshooting are here

https://aws.amazon.com/premiumsupport/knowledge-center/es-troubleshoot-cloudwatch-logs/

Go to Kibana and add your all_access mapping. Voila.