AWS Elasticsearch Policy，只允许 lambda 访问 Elasticsearch答案

【问题标题】：AWS Elastic Search Policy, only allow lambda to access Elastic SearchAWS Elasticsearch Policy，只允许 lambda 访问 Elasticsearch
【发布时间】：2018-11-12 17:07:14
【问题描述】：

我正在努力在AWS 上设置ElasticSearch 实例。我的目标是只允许从我的Lambda 函数到ElasticSearch 实例的http 请求。我创建了一个策略，它给出了'Lambdaaccess to theElasticSearchinstance. The part I'm struggling with is the inline resource policy forElasticSearchthat will deny all other request that aren't from the 'Lambda。

我尝试将ElasticSearch 资源策略设置为Deny 所有请求，然后为我的Lambda 提供一个可以访问ElasticSearch. 的角色虽然Lambda 正在使用该角色，但我正在使用我签署我的http 请求axios 和 aws4 但请求被 The request signature we calculated does not match the signature you provided. 拒绝我认为问题不是请求的实际签名，而是我创建的策略。如果有人能引导我朝着正确的方向前进，那真的很有帮助。

Lambda Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "es:ESHttpGet",
                "es:CreateElasticsearchDomain",
                "es:DescribeElasticsearchDomainConfig",
                "es:ListTags",
                "es:ESHttpDelete",
                "es:GetUpgradeHistory",
                "es:AddTags",
                "es:ESHttpHead",
                "es:RemoveTags",
                "es:DeleteElasticsearchDomain",
                "es:DescribeElasticsearchDomain",
                "es:UpgradeElasticsearchDomain",
                "es:ESHttpPost",
                "es:UpdateElasticsearchDomainConfig",
                "es:GetUpgradeStatus",
                "es:ESHttpPut"
            ],
            "Resource": "arn:aws:es:us-east-1:,accountid>:domain/<es-instance>"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "es:PurchaseReservedElasticsearchInstance",
                "es:DeleteElasticsearchServiceRole"
            ],
            "Resource": "*"
        }
    ]
}

ElasticSearch Inline Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": {
        "AWS": [
          "*"
        ]
      },
      "Action": [
        "es:*"
      ],
      "Resource": "arn:aws:es:us-east-1:<account-number>:domain/<es-instance>/*"
    }
  ]
}

Lambda Code Using Aws4 and Axios

//process.env.HOST = search-<es-instance>-<es-id>.us-east-1.es.amazonaws.com
function createRecipesIndex(url, resolve, reject){

         axios(aws4.sign({
            host: process.env.HOST,
            method: "PUT",
            url: "https://" + process.env.HOST,
            path: '/recipes/',
       }))
      .then(response => {
          console.log("----- SUCCESS INDEX CREATED -----");
        resolve();
      })
      .catch(error => {
          console.log("----- FAILED TO CREATE INDEX -----");
        console.log(error);
        reject();
      });
}

注意：我尝试使用 ElasticSearch 上的内联策略创建索引以允许 *(all) 并删除 aws4 库签名，它工作正常。现在我只想保护对这个资源的访问。

【问题讨论】：

标签： node.js amazon-web-services aws-lambda axios aws-elasticsearch

【解决方案1】：

我找到了我的问题的解决方案，它是 2 倍。第一个问题是我在ElasticSearch 实例上的内联resource policy。我需要更新它以允许我赋予我的Lambda 的角色。这是通过从IAM 获取role arn 来完成的，然后创建以下策略以内联附加到ElasticSearch 实例上。

我的第二个问题是aws4。我设置的path 和url 不匹配。我的路径有/xxxx/，而我的网址是https://search-<es-instance>-<es-id>.us-east-1.es.amazonaws.com/xxxx。由于path 包含url 中未找到的额外正斜杠，因此签名失败。对于使用该库的其他任何人，请确保这些值是一致的。我希望这对将来的其他人有所帮助：D

Elastic Search Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account-id>:role/service-role/<role-name>"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-east-1:<account-id>:domain/<es-instance>/*"
    }
  ]
}

【讨论】：