amazon web services - How do I restrict a user to update and for anyone to search? -
i lock down aws elasticsearch instance users specify allowed "update" index (usually /_bulk
request deleting , creating indexes) , can "search" index (with /_search
request).
this thought work:
{ "version": "2012-10-17", "statement": [ { "sid": "", "effect": "allow", "principal": { "aws": "arn:aws:iam::$myrootid:user/$myusername" }, "action": "es:eshttppost", "resource": "arn:aws:es:us-west-2:$myrootid:domain/mydomainname/*" }, { "sid": "allowanonymoushttpget", "effect": "allow", "principal": { "aws": "*" }, "action": "es:eshttppost", "resource": "arn:aws:es:us-west-2:$myrootid:domain/$mydomainname/_search" } ] }
but doesn't seem work. need both post
can't send body get
request in case.
the error get:
user: arn:aws:iam::$myrootid:user/$myusername not authorized perform: es:eshttppost on resource: $mydomainname
Comments
Post a Comment