AWS SAM Lambda OpenSearch 策略

Question

我无法获得适用于 Lambda function 到 OpenSearch 的有效 IAM 策略。

  Replicate:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-Replicate
      Description: !Sub
        - Stack ${StackTagName} Environment ${EnvironmentTagName} Function ${ResourceName}
        - ResourceName: DBReplicate
      CodeUri: ../src/Replicate
      Handler: index.handler
      Runtime: nodejs16.x
      MemorySize: 3008
      Timeout: 30
      Tracing: Active
      Policies:
        - PolicyName: Access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - es:*
            Resource:
              - arn:aws:es:eu-west-1:22222222222:domain/mynewdomain
              - DomainName: mynewdomain
      Events:
        MyDynamoDBtable:
          Type: DynamoDB
          Properties:
            Stream: !Ref TableStreamArn
            StartingPosition: TRIM_HORIZON
            BatchSize: 1

运行sam validate ，我得到：

“策略”属性中索引 0 处的策略无效

Answer 1

所以最终得到了这个似乎有效的：

      OpenSearchAccess:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "OpenSearchAccess"
      Roles:
        - !Ref MyIamRole
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - 'es:*'
            Resource: arn:aws:es:eu-west-1:222222222:domain/domainname
  MyIamRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - "es.amazonaws.com"
            Action:
              - "sts:AssumeRole"
  Replicate:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-DBReplicate
      Description: !Sub
        - Stack ${StackTagName} Environment ${EnvironmentTagName} Function ${ResourceName}
        - ResourceName: DBReplicate
      CodeUri: ../src/DBReplicate
      Handler: index.handler
      Runtime: nodejs16.x
      MemorySize: 3008
      Timeout: 30
      Tracing: Active
      Policies:
        - !Ref OpenSearchAccess

它是有效的，尽管在部署时收到有关某些无效 ARN 的错误