Attach Policy to AWS Elasticsearch

Question

I have made a whitelist policy containing list of IP address from where I want to get the IP

Sample below, consider Policy ARN is arn:aws:iam::0000000:policy/Whitelister

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Resource": "*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "W.X.Y.Z",
                        "A.B.C.D"
                    ]
                }
            }
        }
    ]
}

I have an AWS Elasticsearch(ES) account, which allows JSON based access policy. How can I use the above policy in AWS ES' policy to restrict access to these IPs only.

I have hard written IPs now, but that will cause redundancy and updating the IPs will be difficult.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "*",
      "Resource": [
        "arn:aws:es:****************/domain-name/*",
        "arn:aws:es:****************/domain-name/"
      ],
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": [
            "W.X.Y.Z",
            "A.B.C.D"
          ]
        }
      }
    }
  ]
}

user_248823 · Answer

Unfortunately, you can't use your policy in IP policy for an ES domain.

Let me elaborate a bit on this, as I think there is a confusion between resource-based policies, such as IP policies for the ES domain, and identity-based policies for IAM users, roles or groups. The differences are explained in the AWS docs.

In short, you policy arn:aws:iam::0000000:policy/Whitelister is, so called, managed-policy. The managed polices can only be attached to IAM identity which can be IAM user, group or role. They can't be attached to resource-based policies.

Attach Policy to AWS Elasticsearch

1 Answers