AWS ElasticSearch 不是从 Lambda 访问的，因为它是从本地主机访问的

Question

我在 AWS 中部署了一个 ElasticSearch 实例，该实例可通过公共方式访问。 我可以轻松地在本地主机上查询数据，但是当我在 Aws lambda 上部署时，出现以下错误

消息：'用户：arn:aws:sts::xxxxxxxx:assumed-role/infrastruct-dev-us-east-2-lambdaRole/zeong-immigration-infrastruct-dev-app 无权执行：es:ESHttpPost 因为没有基于身份的策略允许 es:ESHttpPost 操作'

这是我的 serverless.yaml

    iamRoleStatements:
      - Effect: Allow
      Action:
        - es:ESHttpPost
        - es:ESHttpPut
        - es:ESHttpDelete
        - es:ESHttpGet
      Resource:
        - {'Fn::GetAtt': ['ElasticSearchInstance', 'DomainArn']}
        - {
            'Fn::Join':
              [
                '',
                [
                  'Fn::GetAtt': ['ElasticSearchInstance', 'DomainArn'],
                  '/*',
                ],
              ],
          }
      Condition:
        IpAddress:
          aws:SourceIp:
            - '0.0.0.0' # Whitelisted IP
  resources:
   Resources:
    ElasticSearchInstance:
      Type: AWS::Elasticsearch::Domain
      Properties:
        EBSOptions:
          EBSEnabled: true
          VolumeType: gp2
          VolumeSize: 10
        ElasticsearchClusterConfig:
          InstanceType: t2.small.elasticsearch
          InstanceCount: 1
          DedicatedMasterEnabled: false
          ZoneAwarenessEnabled: false
        ElasticsearchVersion: 5.3
        AccessPolicies:
          Version: '2012-10-17'
          Statement:
            - Effect: 'Allow'
              Principal:
                AWS: '*'
              Action: 'es:*'
              Resource: '*'
              Condition:
                IpAddress:
                  aws:SourceIp: ['182.177.251.40', '103.115.199.162']
        AdvancedOptions:
          rest.action.multi.allow_explicit_index: 'tru

e'

请帮忙

Answer 1

尝试将您的 ActionPolicies 操作设置为

Action: [
    "es:*"
],

好像你忘记了'[]'

在此处查看文档： https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html

Answer 2

我能够通过在此处提到的 ElasticSearch 实例中使用主体来解决上述问题

删除后仍然没有解决错误

  Condition:
    IpAddress:
      aws:SourceIp:
        - '0.0.0.0' # Whitelisted IP

从 IamRoleStatements 我能够解决这个问题