从 Lambda Function 访问 AWS Elasticsearch

Question

我正在尝试从 Lambda function 访问我的 AWS Elasticsearch。

使用无服务器框架和基于 IP 的访问策略，我已经能够在本地实现这一点。

For the deployed lambda function I tried using the ARN of the Lambda Function Role and the ARN of the Lambda function (the one on the top right when viewing the function in the console) in my access policy.

可悲的是我仍然收到以下错误： User: anonymous is not authorized to perform: es:ESHttpPost

这是我的 AWS 访问策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn-of-lambda-function-role"
      },
      "Action": "es:*",
      "Resource": "my-resource-arn"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "my-resource-arn",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "my-ip"
        }
      }
    }
  ]
}

Answer 1

您是否正在签署对 ES 实例的请求？ 根据https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html#es-managedomains-signing-service-requests

要调用 Elasticsearch API，您必须签署自己的请求。