代码之家 › 专栏 › 技术社区 › VirtualProdigy

AWS弹性搜索策略,只允许lambda访问弹性搜索

aws-elasticsearch axios aws-lambda amazon-web-services node.js

VirtualProdigy · 技术社区 · 7 年前

我正在建立一个 ElasticSearch AWS Lambda 弹性搜索 实例。我创建了一个策略,它给出了 access to the 弹性搜索 instance. The part I'm struggling with is the inline resource policy for 弹性搜索 that will deny all other request that aren't from the 'Lambda .

我试过设置资源策略到 Deny λ 具有访问权限的角色 ElasticSearch. 而 axios aws4 但是请求被拒绝了 The request signature we calculated does not match the signature you provided.

Lambda Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "es:ESHttpGet",
                "es:CreateElasticsearchDomain",
                "es:DescribeElasticsearchDomainConfig",
                "es:ListTags",
                "es:ESHttpDelete",
                "es:GetUpgradeHistory",
                "es:AddTags",
                "es:ESHttpHead",
                "es:RemoveTags",
                "es:DeleteElasticsearchDomain",
                "es:DescribeElasticsearchDomain",
                "es:UpgradeElasticsearchDomain",
                "es:ESHttpPost",
                "es:UpdateElasticsearchDomainConfig",
                "es:GetUpgradeStatus",
                "es:ESHttpPut"
            ],
            "Resource": "arn:aws:es:us-east-1:,accountid>:domain/<es-instance>"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "es:PurchaseReservedElasticsearchInstance",
                "es:DeleteElasticsearchServiceRole"
            ],
            "Resource": "*"
        }
    ]
}

ElasticSearch Inline Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": {
        "AWS": [
          "*"
        ]
      },
      "Action": [
        "es:*"
      ],
      "Resource": "arn:aws:es:us-east-1:<account-number>:domain/<es-instance>/*"
    }
  ]
}

Lambda Code Using Aws4 and Axios

//process.env.HOST = search-<es-instance>-<es-id>.us-east-1.es.amazonaws.com
function createRecipesIndex(url, resolve, reject){

         axios(aws4.sign({
            host: process.env.HOST,
            method: "PUT",
            url: "https://" + process.env.HOST,
            path: '/recipes/',
       }))
      .then(response => {
          console.log("----- SUCCESS INDEX CREATED -----");
        resolve();
      })
      .catch(error => {
          console.log("----- FAILED TO CREATE INDEX -----");
        console.log(error);
        reject();
      });
}

弹性搜索 设置为allow*(all)并删除 aws4 图书馆签名和它的工作很好。现在我只想保护对这个资源的访问。

1 回复 | 直到 7 年前

VirtualProdigy 7 年前

我找到了解决我的问题的方法,它是双重的。第一个问题是我的内联问题 resource policy 在我的 ElasticSearch Lambda . 这是通过 role arn IAM 然后创建要内联附加到 弹性搜索 实例。

aws4 . 这个 path url 我的设置不匹配。我的人生道路 /xxxx/ 当我的网址 https://search-<es-instance>-<es-id>.us-east-1.es.amazonaws.com/xxxx . 自从 路径 ,签名失败。对于其他使用库的人,请确保这些值是一致的。我希望这能在将来帮助别人:D

Elastic Search Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account-id>:role/service-role/<role-name>"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-east-1:<account-id>:domain/<es-instance>/*"
    }
  ]
}