Unable to add Fine grain access for Elasticsearch service for Cloudformation

user_6918812 0
Viewed 3069

I am creating CloudFormation stack with Elasticsearch service, however it fails for AdvancedSecurityOptions, which works perfectly fine with aws es create-elasticsearch-domain

my JSON template snippet is below:

...
"AdvancedOptions": {
    "rest.action.multi.allow_explicit_index": true
},
"AdvancedSecurityOptions": {
    "Enabled": true,
    "InternalUserDatabaseEnabled": false,
    "MasterUserOptions": {
    "MasterUserARN": "arn:aws:iam::1234567890:role/role_name"
    }
},
"DomainName": {
    "Ref": "ESDomainName"
}
...

I am unable to get this code working, any help related to fine grain access control would be really appreciated.

aws-elasticsearch amazon-cloudformation elasticsearch amazon-web-services json
3 Answers

The AdvancedSecurityOptions is the latest addition to Amazon Elasticsearch service added recently as part of Fine Grained Access Control. This is available only via Console, CLI and API for now.

user_73034470

I am not sure if the thread is with outdated info, but according to the official AWS documentation on this link it should be possible to use the AdvancedSecurityOptions for Fine Grained Access Control. It even states that it is meant to be used for FGAC at the top of the page.

user_124385090

Continuing from DNakevski@ answer above, for FGAC we need to ensure the following three settings in the CFN template are set to true since they serve as pre-requisites:

  • EncryptionAtRestOptions
  • NodeToNodeEncryptionOptions and
  • HTTPS.

Further, the important parameter for FGAC in the CFN template is AdvancedSecurityOptions and needs to be set to Enabled: true

AmazonES/Opendistro-for-ES provides two ways for security with FGAC. One is through using a IAM user as a master-user and other is through having basic auth.

  • If you need to take the IAM way then set the InternalUserDatabaseEnabled to false and only have the parameter *MasterUserARN: "IAM User ARN" under the MasterUserOptions field.

  • If you need to take the basic auth (username and password) approach set the InternalUserDatabaseEnabled to true and have the MasterUserName: "any-name" and the MasterUserPassword: "xxx"* Please have at least one lower case, one upper case, one digit and one special character for the password else the CFN template will rollback. However, the failure message is easily seen on the CFN console under events.

I have a simple working CFN yaml here doing the same just in case.

user_79020020
Related