3

我正在努力ElasticSearch在AWS. 我的目标是只允许从我的Lambda函数到ElasticSearch实例的 http 请求。我创建了一项策略，它提供了 'Lambda access to theElasticSearch instance. The part I'm struggling with is the inline resource policy forElasticSearch that will deny all other request that aren't from the 'Lambda。

我已经尝试将ElasticSearch资源策略设置为Deny所有请求，然后给我Lambda一个可以访问的角色ElasticSearch.虽然Lambda正在使用该角色，但我正在使用axios和aws4签署我的 http 请求，但请求被拒绝，The request signature we calculated does not match the signature you provided.我认为问题不是实际签署请求，而不是我创建的策略。如果有人能引导我朝着正确的方向前进，那真的很有帮助。

Lambda Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "es:ESHttpGet",
                "es:CreateElasticsearchDomain",
                "es:DescribeElasticsearchDomainConfig",
                "es:ListTags",
                "es:ESHttpDelete",
                "es:GetUpgradeHistory",
                "es:AddTags",
                "es:ESHttpHead",
                "es:RemoveTags",
                "es:DeleteElasticsearchDomain",
                "es:DescribeElasticsearchDomain",
                "es:UpgradeElasticsearchDomain",
                "es:ESHttpPost",
                "es:UpdateElasticsearchDomainConfig",
                "es:GetUpgradeStatus",
                "es:ESHttpPut"
            ],
            "Resource": "arn:aws:es:us-east-1:,accountid>:domain/<es-instance>"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "es:PurchaseReservedElasticsearchInstance",
                "es:DeleteElasticsearchServiceRole"
            ],
            "Resource": "*"
        }
    ]
}

ElasticSearch Inline Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": {
        "AWS": [
          "*"
        ]
      },
      "Action": [
        "es:*"
      ],
      "Resource": "arn:aws:es:us-east-1:<account-number>:domain/<es-instance>/*"
    }
  ]
}

Lambda Code Using Aws4 and Axios

//process.env.HOST = search-<es-instance>-<es-id>.us-east-1.es.amazonaws.com
function createRecipesIndex(url, resolve, reject){

         axios(aws4.sign({
            host: process.env.HOST,
            method: "PUT",
            url: "https://" + process.env.HOST,
            path: '/recipes/',
       }))
      .then(response => {
          console.log("----- SUCCESS INDEX CREATED -----");
        resolve();
      })
      .catch(error => {
          console.log("----- FAILED TO CREATE INDEX -----");
        console.log(error);
        reject();
      });
}

注意：我尝试使用ElasticSearch设置为允许 *(all) 的内联策略创建索引并删除aws4库签名，它工作正常。现在我只想保护对这个资源的访问。

4

1 回答 1

2

我找到了我的问题的解决方案，它是 2 倍。第一个问题是我resource policy在我的ElasticSearch实例上的内联。我需要更新它以允许我赋予我的Lambda. 这是通过获取role arnfromIAM然后创建以下策略以内联到ElasticSearch实例上来完成的。

我的第二个问题是aws4. path和我设置的不url匹配。当我/xxxx/的 url 是https://search-<es-instance>-<es-id>.us-east-1.es.amazonaws.com/xxxx. 由于在path中找不到额外的正斜杠url，因此签名失败。对于使用该库的其他任何人，请确保这些值是一致的。我希望这对将来的其他人有所帮助：D

Elastic Search Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account-id>:role/service-role/<role-name>"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-east-1:<account-id>:domain/<es-instance>/*"
    }
  ]
}
于 2018-11-12T18:30:36.640 回答