如何手动设置 AWS ElasticSearch 并通过浏览器使用 kibana？

Question

我一直在努力设置 AWS ES 和使用 kibana。我在关注Amazon Elasticsearch Service docs on AWS。

当我到达Step 2: Upload Data to an Amazon ES Domain for Indexing 时，我无法按照文档指示运行curl -XPUT elasticsearch_domain_endpoint/movies/_doc/1 -d '{"director": "Burton, Tim", "genre": ["Comedy","Sci-Fi"], "year": 1996, "actor": ["Jack Nicholson","Pierce Brosnan","Sarah Jessica Parker"], "title": "Mars Attacks!"}' -H 'Content-Type: application/json'，出现{"Message":"User: anonymous is not authorized to perform: es:ESHttpPut"} 的错误。

我将 ES 的策略设置为：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::my_id:user/my_iam_user"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-west-2:my_id:domain/my-domain/*"
    },
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-west-2:my_id:domain/my-domain/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [my_ips]
        }
      }
    }
  ]
}

我通过从终端调用ifconfig | grep "inet " | grep -v 127.0.0.1，点击checkip.amazonaws.com，并检查开发者工具 -> chrome 上的网络来获得上述 IP（这些是 3 个不同的 IP，我将它们全部添加）。

我还为我的 IAM 用户添加了以下角色：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "es:DescribeReservedElasticsearchInstanceOfferings",
                "es:DescribeReservedElasticsearchInstances",
                "es:ListDomainNames",
                "es:PurchaseReservedElasticsearchInstance",
                "es:DeleteElasticsearchServiceRole",
                "es:ListElasticsearchInstanceTypes",
                "es:DescribeElasticsearchInstanceTypeLimits",
                "es:ListElasticsearchVersions"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "es:*",
            "Resource": "arn:aws:es:us-west-2:my_id:domain/my-domain"
        }
    ]
}

我已经在我的机器上设置了 AWS CLI，我可以通过 aws es describe-elasticsearch-domain --domain my-domain 获得正确的结果。

不过，我还是没有调用上面的curl XPUT，也因为同样的原因无法访问kibana{"Message":"User: anonymous is not authorized to perform: es:ESHttpPut"}

这是我在这里提出问题之前阅读的几篇文章：

1. https://aws.amazon.com/premiumsupport/knowledge-center/anonymous-not-authorized-elasticsearch/?nc1=h_ls
2. https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html
3. https://aws.amazon.com/cn/blogs/database/set-access-control-for-amazon-elasticsearch-service/
4. Proper access policy for Amazon Elastic Search Cluster
5. https://aws.amazon.com/cn/blogs/security/how-to-control-access-to-your-amazon-elasticsearch-service-domain/

但仍然无法正常工作。

谁能指导我完成手动设置 AWS ES 的整个过程，并能够通过 AWS CLI 以及浏览器上的 kibana 进行操作？如果它可以是详细的分步指南而不是抛出 aws 文档，我将不胜感激。非常感谢。

Answer 1

原来我使用的 IP 不正确。我应该在不在 VPN 下时打电话给checkip.amazonaws.com，IP 可能会改变。 ES 的策略应该是这样的：Anther Answer

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::xxxxxxxxxxxx:root"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-west-2:xxxxxxxxxxxx:domain/my-elasticsearch-domain/*"
    },
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-west-2:xxxxxxxxxxxx:domain/my-elasticsearch-domain/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "192.168.1.0",
            "192.168.1.1"
          ]
        }
      }
    }
  ]
}

*PS。确保您在同一个浏览器上调用 checkip.amazonaws.com（如果您使用的是 chrome，则也是同一个用户）