AWS Cloudformation - Elasticsearch 访问控制策略服务错误 InvalidTypeException

Question

I want to limit access to my elasticsearch clusters on aws by defining Access Policies that would limit access to iam users, a specific lambda function and the appsync api.

I have defined the following access policies in the elasticsearch resource on cloudformation, but this is failing with an error: Service: AWSElasticsearch; Status Code: 409; Error Code: InvalidTypeException; Service: AWSElasticsearch; Status Code: 409; Error Code: InvalidTypeException;

How do I fix my policy so that it works?

"Type": "AWS::Elasticsearch::Domain",
        "Properties": {
            "AccessPolicies": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": [
                                {
                                    "Fn::Join": [
                                        "",
                                        [
                                            "arn:aws:lambda:",
                                            {"Ref": "AWS::Region"},
                                            ":",
                                            {"Ref": "AWS::AccountId"},
                                            ":function:",
                                            {"Ref": "DdEsLambdaFunctionName"},
                                            "-",
                                            {"Ref": "env"}
                                        ]
                                    ]
                                },
                                {
                                    "Fn::Join": [
                                        "",
                                        [
                                            {"Ref": "GraphQLAPI"},
                                            "/*"
                                        ]
                                    ]
                                }
                            ]
                        },
                        "Action": [
                            "es:ESHttp*"
                        ]
                    },
                    {
                        "Effect": "Allow",
                        "Principal": [
                            {
                                "AWS": {
                                    "Fn::Join": [
                                        "",
                                        [
                                            "arn:aws:iam::",
                                            {"Ref": "AWS::AccountId"},
                                            ":user/*"
                                        ]
                                    ]
                                }
                            }
                        ],
                        "Action": "*"
                    }
                ]
            },...}

Answer 1

Not sure if this is the core issue, but your first Principal is incorrect.

You specified Service but you provide lambda ARN. The ARN is of type AWS principal, not Service . Possibly GraphQLAPI is also an ARN, which again is not a Service principal, but AWS Principal.