I've started learning elasticsearch using AWS I followed this article to create elasticsearch and Kibana setup
After completing the setup, tried to log in using my user from user pool, after login I'm getting error "Missing Role"
3 Answers
Was looking all over for the fix after following the same guide you linked. Came across this post during my searching and wanted to update my fix for that specific guide is to use Elasticsearch 6.2 when creating the domain.
I haven't tried any other versions but when I switched from ES 7.4 (latest) to 6.2 (which is mentioned in the guide) it worked with no issues.
What worked for me is below on ES 7.4,
- Open Identity Pool
- Click "Edit identity pool"
- Authentication Providers
- Authenticated Role Section
- Choose role from token
- Role resolution: DENY
This document had the answer that worked for me: https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/fgac.html#fgac-walkthrough-iam
The real issue was that the role I was using on the identity pool and elasticsearch cluster did not have a trust relationship policy to allow the identity pool to assume the role. So login was succeeding, but the pool wasn't able to assume the role, and therefore there really was a missing role on the token that Kibana was receiving. Adding the trust relationship policy shown in step 4 of the doc in addition to the policy allowing kibana to assume the role, fixed the missing role issue for me and successfully passed my authenticated user into kibana's main interface.
Related