时间戳

首页 > 解决方案 > 如何手动设置 AWS ElasticSearch 并通过浏览器使用 kibana？

amazon-web-services - 如何手动设置 AWS ElasticSearch 并通过浏览器使用 kibana？

问题描述

我一直在努力设置 AWS ES 和使用 kibana。我正在关注AWS 上的 Amazon Elasticsearch Service 文档。

当我进入第 2 步：将数据上传到 Amazon ES 域以进行索引curl -XPUT elasticsearch_domain_endpoint/movies/_doc/1 -d '{"director": "Burton, Tim", "genre": ["Comedy","Sci-Fi"], "year": 1996, "actor": ["Jack Nicholson","Pierce Brosnan","Sarah Jessica Parker"], "title": "Mars Attacks!"}' -H 'Content-Type: application/json'时，我按照文档指示运行失败，出现{"Message":"User: anonymous is not authorized to perform: es:ESHttpPut"}.

我将 ES 的策略设置为：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::my_id:user/my_iam_user"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-west-2:my_id:domain/my-domain/*"
    },
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-west-2:my_id:domain/my-domain/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [my_ips]
        }
      }
    }
  ]
}

我通过ifconfig | grep "inet " | grep -v 127.0.0.1从终端调用、点击checkip.amazonaws.com并检查 Chrome 上的 Developer Tools -> Network 获得了上面的 IP（这些是 3 个不同的 IP，我将它们全部添加）。

我还为我的 IAM 用户添加了以下角色：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "es:DescribeReservedElasticsearchInstanceOfferings",
                "es:DescribeReservedElasticsearchInstances",
                "es:ListDomainNames",
                "es:PurchaseReservedElasticsearchInstance",
                "es:DeleteElasticsearchServiceRole",
                "es:ListElasticsearchInstanceTypes",
                "es:DescribeElasticsearchInstanceTypeLimits",
                "es:ListElasticsearchVersions"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "es:*",
            "Resource": "arn:aws:es:us-west-2:my_id:domain/my-domain"
        }
    ]
}

我已经在我的机器上设置了 AWS CLI，并且能够通过aws es describe-elasticsearch-domain --domain my-domain.

尽管如此，我还是curl XPUT因为同样的原因未能在上面调用并未能访问 kibana{"Message":"User: anonymous is not authorized to perform: es:ESHttpPut"}

这是我在这里提出问题之前阅读的几篇文章：

  1. https://aws.amazon.com/premiumsupport/knowledge-center/anonymous-not-authorized-elasticsearch/?nc1=h_ls
  2. https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html
  3. https://aws.amazon.com/cn/blogs/database/set-access-control-for-amazon-elasticsearch-service/
  4. Amazon Elastic Search 集群的正确访问策略
  5. https://aws.amazon.com/cn/blogs/security/how-to-control-access-to-your-amazon-elasticsearch-service-domain/

仍然无法让它工作。

任何人都可以指导我手动设置 AWS ES 的整个过程，并能够通过 AWS CLI 以及浏览器上的 kibana 进行操作吗？如果它可以是详细的分步指南而不是抛出 aws 文档，我将不胜感激。非常感谢。

标签： amazon-web-serviceselasticsearch

解决方案

事实证明，我使用的 IP 不正确。我应该checkip.amazonaws.com在不在 VPN 下的时候打电话，而且 IP 可能会改变。ES 的政策应该是这样的：Anther Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::xxxxxxxxxxxx:root"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-west-2:xxxxxxxxxxxx:domain/my-elasticsearch-domain/*"
    },
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-west-2:xxxxxxxxxxxx:domain/my-elasticsearch-domain/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "192.168.1.0",
            "192.168.1.1"
          ]
        }
      }
    }
  ]
}

*附注。确保您checkip.amazonaws.com在同一个浏览器上调用（如果您使用的是 chrome，则也是同一个用户）

推荐阅读