[英]Add multiple domain access policy to AWS Elasticsearch Service (Static IP and Lambda ARN)
设置AWS Elasticsearch之后,我在静态IP服务器上安装了Logstash和Kibana代理,并在ES上添加了这个域访问策略,它运行正常:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "es:*",
"Resource": "arn:aws:es:ap-southeast-1:323137313233:domain/sg-es-logs/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": [
"192.192.192.192"
]
}
}
}
]
}
现在我需要允许Lambda函数在AWS ES上执行es:ESHttpDelete
操作,因此我使用现有角色service-role/Elasticsearch
创建了该函数,然后从IAM Managment控制台复制了相关的ARN
,将其添加到AWS ES访问策略,想出这个:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam:: 323137313233:role/service-role/Elasticsearch"
]
},
"Action": [
"es:*"
],
"Resource": "arn:aws:es:ap-southeast-1:323137313233:domain/sg-es-logs/*"
}
]
}
问题出在ES我应该为静态IP或ARN选择域访问策略,但不能同时选择两者。 当我尝试手动合并它们而不是使用控制台时,它不起作用。 我检查了AWS文档,但他们没有提到是否可能。
您可以使用JSON格式的策略在Statement
数组中添加多个策略语句。 所以,你的最终政策将是这样的:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "es:*",
"Resource": "arn:aws:es:ap-southeast-1:323137313233:domain/sg-es-logs/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": [
"192.192.192.192"
]
}
}
},
{
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam:: 323137313233:role/service-role/Elasticsearch"
]
},
"Action": [
"es:*"
],
"Resource": "arn:aws:es:ap-southeast-1:323137313233:domain/sg-es-logs/*"
}
]
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.