![](/img/trans.png)
[英]AWS permissions error … Kinesis Firehose is not sending data to Elasticsearch…
[英]AWS Kinesis Firehose is not sending data to Elasticsearch…IAM permissions?
因此,除了将数据从 Firehose 发送到 Elasticsearch 的最后一步之外,我已经准备好一切并且工作正常。
这是我在 Kinesis Firehose Elasticsearch 服务日志中遇到的错误:
Error received from Elasticsearch cluster. {"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [indices:data/write/bulk] and User [name=arn:aws:iam::917877325894:role/firehose_delivery_role, backend_roles=[arn:aws:iam::917877325894:role/firehose_delivery_role], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [indices:data/write/bulk] and User [name=arn:aws:iam::917877325894:role/firehose_delivery_role, backend_roles=[arn:aws:iam::917877325894:role/firehose_delivery_role], requestedTenant=null]"},"status":403}
这是我附加的 IAM 政策(由 Firehose 自己制定)
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeVpcAttribute",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeNetworkInterfaces",
"ec2:CreateNetworkInterface",
"ec2:CreateNetworkInterfacePermission",
"ec2:DeleteNetworkInterface"
],
"Resource": "*"
},
{
"Sid": "",
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::test-kinesis-backup-mydna",
"arn:aws:s3:::test-kinesis-backup-mydna/*"
]
},
{
"Sid": "",
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction",
"lambda:GetFunctionConfiguration"
],
"Resource": "arn:aws:lambda:us-west-2:917877325894:function:%FIREHOSE_DEFAULT_FUNCTION%:%FIREHOSE_DEFAULT_VERSION%"
},
{
"Sid": "",
"Effect": "Allow",
"Action": [
"es:DescribeElasticsearchDomain",
"es:DescribeElasticsearchDomains",
"es:DescribeElasticsearchDomainConfig",
"es:ESHttpPost",
"es:ESHttpPut"
],
"Resource": [
"arn:aws:es:us-west-2:917877325894:domain/test-dynamodb",
"arn:aws:es:us-west-2:917877325894:domain/test-dynamodb/*"
]
},
{
"Sid": "",
"Effect": "Allow",
"Action": [
"es:ESHttpGet"
],
"Resource": [
"arn:aws:es:us-west-2:917877325894:domain/test-dynamodb/_all/_settings",
"arn:aws:es:us-west-2:917877325894:domain/test-dynamodb/_cluster/stats",
"arn:aws:es:us-west-2:917877325894:domain/test-dynamodb/test_dynamodb*/_mapping/",
"arn:aws:es:us-west-2:917877325894:domain/test-dynamodb/_nodes",
"arn:aws:es:us-west-2:917877325894:domain/test-dynamodb/_nodes/stats",
"arn:aws:es:us-west-2:917877325894:domain/test-dynamodb/_nodes/*/stats",
"arn:aws:es:us-west-2:917877325894:domain/test-dynamodb/_stats",
"arn:aws:es:us-west-2:917877325894:domain/test-dynamodb/test_dynamodb*/_stats"
]
},
{
"Sid": "",
"Effect": "Allow",
"Action": [
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:us-west-2:917877325894:log-group:/aws/kinesisfirehose/test_dynamodb:log-stream:*"
]
},
{
"Sid": "",
"Effect": "Allow",
"Action": [
"kinesis:DescribeStream",
"kinesis:GetShardIterator",
"kinesis:GetRecords",
"kinesis:ListShards"
],
"Resource": "arn:aws:kinesis:us-west-2:917877325894:stream/%FIREHOSE_STREAM_NAME%"
},
{
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": [
"arn:aws:kms:us-west-2:917877325894:key/%SSE_KEY_ID%"
],
"Condition": {
"StringEquals": {
"kms:ViaService": "kinesis.%REGION_NAME%.amazonaws.com"
},
"StringLike": {
"kms:EncryptionContext:aws:kinesis:arn": "arn:aws:kinesis:%REGION_NAME%:917877325894:stream/%FIREHOSE_STREAM_NAME%"
}
}
}
]
}
我尝试添加所有不同的策略,但无法使其正常工作,并且我不断收到相同的错误消息。
有什么建议么?
我刚刚遇到了同样的问题。 我的问题是我不小心将 firehose ARN 分配到 ES 角色映射,而不是 IAM ARN。
Elastic Search > Security > firehose_delivery_role > mapped users > backend role > {{ 这需要是 IAM firehose ARN,而不是 firehose ARN itselt }}
不正确:arn:aws:firehose:us-east-1:000000012345:deliverystream/workshop-firehose
正确:arn:aws:iam::000000012345:role/service-role/KinesisFirehoseServiceRole-workshop-fire-us-east-1-1609335111111
在发现错误之前,我还尝试将 [indices:data/write/bulk] 和 [indices:data/write/bulk*] 添加到 ES 角色的集群和索引权限......但这没有帮助。
希望这可以帮助其他在类似问题上苦苦挣扎的人。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.