amazon-web-services - AWS Elasticsearch IAM 作为主用户获取 AuthorizationException 试图放置数据

Question

ES 角色选择控制台截图

尝试将文档放入 AWS ES 集群。代码：

from elasticsearch import Elasticsearch, RequestsHttpConnection
from requests_aws4auth import AWS4Auth
import boto3

host = 'search-dev-operations-2-XXXXXXXX.us-east-2.es.amazonaws.com' # For example, my-test-domain.us-east-1.es.amazonaws.com
region = 'us-east-2' # e.g. us-west-1

service = 'es'
credentials = boto3.Session().get_credentials()
awsauth = AWS4Auth(credentials.access_key, credentials.secret_key, region, service, session_token=credentials.token)

es = Elasticsearch(
    hosts = [{'host': host, 'port': 443}],
    http_auth = awsauth,
    use_ssl = True,
    verify_certs = True,
    connection_class = RequestsHttpConnection
)

document = {
    "title": "Moneyball",
    "director": "Bennett Miller",
    "year": "2011"
}


es.index(index="dev-operations-2", doc_type="_doc", id="5", body=document)

print(es.get(index="dev-operations-2", doc_type="_doc", id="5"))

收到此错误消息：

elasticsearch.exceptions.AuthorizationException: AuthorizationException(403, '{"Message":"User: arn:aws:iam::XXXXXX:user/[e-mail] is not authorized to perform: es:ESHttpPut with an explicit deny"}')

arn:aws:iam::XXXXXX:user/[e-mail]通过精细访问设置为 IAM 主用户。这是我的 AWS 用户

有人可以帮我吗？不知道为什么我没有被授权。

ES集群详情截图

标签： amazon-web-serviceselasticsearchamazon-iam

Answer 1

这在 ElasticSearch 中不是问题，这是根据与您的 IAM 用户关联的策略被阻止的。

转到 IAM 服务控制台并查找[e-mail]用户的权限。似乎有一个“拒绝”语句与附加到与该es:ESHttpPut操作匹配的用户的组/策略之一相关联。