AWS SDK JavaScript - 我们计算的请求签名与您提供的签名不匹配

Question

I am trying to sign my HTTP request from my Lambda function to access my Elasticsearch endpoint as described here . I dont know is there a better way for doing this but I am getting status 403 error with the following response. How can i troubleshoot this error and identify the problem with my signature?

{
"message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details."

}

My Lambda function has IAM role ( ROLE_X ) with below permissions.

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "es:ESHttpPost",
            "es:ESHttpPut",
            "dynamodb:DescribeStream",
            "dynamodb:GetRecords",
            "dynamodb:GetShardIterator",
            "dynamodb:ListStreams",
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
        ],
        "Resource": "*"
    }
]

}

I am also allowing access to this role in my Elasticsearch domain by providing ROLE_X's arn as Custom Access Policy.

Here is my lambda function written in NodeJS

'use strict';
var AWS = require('aws-sdk');
var region = 'eu-central-1';
var domain = 'search-mydomain-XXXX.eu-central-1.es.amazonaws.com';
var index = 'images';
var type = 'image';
var credentials = new AWS.EnvironmentCredentials('AWS');

exports.handler = (event, context, callback) => {
    var endpoint = new AWS.Endpoint(domain);
    var request = new AWS.HttpRequest(endpoint, region);

    request.headers['host'] = domain;
    request.headers['Content-Type'] = 'application/json';
    // Content-Length is only needed for DELETE requests that include a request
    // body, but including it for all requests doesn't seem to hurt anything.
    request.headers['Content-Length'] = Buffer.byteLength(request.body);
    request.path += index + '/' + type + '/';
   
    let count = 0;
    event.Records.forEach((record) => {
        const id = JSON.stringify(record.dynamodb.Keys.id.S);
        request.path += id;
        if (record.eventName == 'REMOVE') {
            request.method = 'DELETE';
            console.log('Deleting document');
        }
        else { // record.eventName == 'INSERT'
            request.method = 'PUT';
            request.body = JSON.stringify(record.dynamodb.NewImage);
            console.log('Adding document' + request.body);
        }
        // Signing HTTP Requests to Elasticsearch Service
        var signer = new AWS.Signers.V4(request, 'es');
        signer.addAuthorization(credentials, new Date());
        
        // Sending HTTP Request to Elasticsearch Service
        var client = new AWS.HttpClient();
        client.handleRequest(request, null, function(response) {
            console.log('sending request to ES');
            console.log(response.statusCode + ' ' + response.statusMessage);
            var responseBody = '';
            response.on('data', function(chunk) {
                responseBody += chunk;
            });
            response.on('end', function(chunk) {
                console.log('Response body: ' + responseBody);
            });
        }, function(error) {
            console.log('ERROR: ' + error);
            callback(error);
        });
        request.path = request.path.replace(id, "");
        count += 1;
        console.log("COUNT :" + count);
    });
    
    callback(null, `Successfully processed ${count} records.`);
};

Answer 1

You can use the http-aws-es library. It uses aws-sdk to handle the signing of requests before accessing your ES endpoint. You can try the following changes to your code using http-aws-es.

var es = require('elasticsearch');
var AWS = require('aws-sdk');
    
AWS.config.update({
    credentials: new AWS.EnvironmentCredentials('AWS'),
    region: 'yy-region-1'
});
const client = es.Client({
    hosts: ['https://xxxx.yy-region-1.es.amazonaws.com/'],
    connectionClass: require('http-aws-es'),
    awsConfig: new AWS.Config({region: 'yy-region-1'})
});    

await client.search(....)