允许从IP地址或IAM用户进行访问的AWS访问策略

Question

我正在使用AWS Elasticsearch，并且需要设置访问策略以允许从固定IP访问以访问Kibana和Web界面。 我还希望允许特定的用户访问密钥能够从任何IP访问它，因为将从我们的服务器中插入记录。

所以它归结为创建一个策略，我需要一个or关系IP和ARN 。

这是我的IP政策的样子：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-west-2:xxxxxx:domain/xxxx-xxxx-xxx/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "xxx.xx.xx.173"
        }
      }
    }
  ]
}

这是我的ARN政策的样子：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::xxxxxxxxx:user/xxxx"
        ]
      },
      "Action": [
        "es:*"
      ],
      "Resource": "arn:aws:es:us-west-2:xxxxxxxxx:domain/xxxxxxxxxxxxxxxx/*"
    }
  ]
}

如何获得它们之间的关系？

Answer 1

如果我正确理解了您的问题，则应该通过将两个语句对象添加到statement数组中来实现所需的功能，例如：

 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-west-2:xxxxxx:domain/xxxx-xxxx-xxx/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "xxx.xx.xx.173"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::xxxxxxxxx:user/xxxx"
        ]
      },
      "Action": [
        "es:*"
      ],
      "Resource": "arn:aws:es:us-west-2:xxxxxxxxx:domain/xxxxxxxxxxxxxxxx/*"
    }
  ]
}