{“Message”：“用户:匿名无权执行: es:ESHttpGet"}
{“Message”：“用户:匿名无权执行: es:ESHttpGet"}
提问于 2021-07-01 14:42:03
我尝试单击ES-cluster中的Kibana-Link。但是，我收到这个错误：
{"Message":"User: anonymous is not authorized to perform: es:ESHttpGet"}ES集群的访问策略为：
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::account-number:role/my-role"
},
"Action": "es:ESHttpGet",
"Resource": "arn:aws:es:my-region:account-number:domain/my-es-domain/*"
},
{
"Effect": "Allow",
"Principal": "*",
"Action": "es:*",
"Resource": "arn:aws:es:my-region:account-number:domain/my-es-domain/*",
"Condition": {
"IpAddress": {
"SourceIp": "xx.xxx.xxx.xx"
}
}
}
]
}和代码：
const policy1: PolicyStatement = new PolicyStatement({
effect: Effect.ALLOW,
resources: ["arn:aws:es:my-region:account-number:domain/my-es-domain/*"],
actions: ["es:ESHttpGet"],
principals: [
new ArnPrincipal("arn:aws:iam::account-number:role/my-role")
],
});
const policy2: PolicyStatement = new PolicyStatement({
effect: Effect.ALLOW,
resources: ["arn:aws:es:my-region:account-number:domain/my-es-domain/*"],
actions: ["es:*"],
principals: [
new ArnPrincipal("*")
],
conditions: {
IpAddress: {
SourceIp: ["xx.xxx.xxx.xx"]
}
}
});
// es cluster
// @ts-ignore
const elasticsearchDomain = new Domain(this,
'ElasticsearchDomain',
{
accessPolicies: [policy1, policy2],
domainName: 'my-es-domain',
version: ElasticsearchVersion.V7_10,
capacity: {
dataNodeInstanceType: "r6g.large.elasticsearch"
}
}
);在部署我的应用程序时，我不能单击ES-Cluster中的Kibana-Link，但如果我将上面的访问策略修改为：
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::account-number:role/my-role"
},
"Action": "es:ESHttpGet",
"Resource": "arn:aws:es:my-region:account-number:domain/my-es-domain/*"
},
{
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "es:*",
"Resource": "arn:aws:es:my-region:account-number:domain/my-es-domain/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "xx.xxx.xxx.xx"
}
}
}
]
}然后它就起作用了。
访问策略的唯一区别是主体中的以下语句：
"Principal": {
"AWS": "*"
}有谁知道如何修复它吗？或者我应该如何以编程方式调整我的代码？
谢谢。
回答 1
Stack Overflow用户
发布于 2021-07-01 14:48:32
此错误表示您的ElasticSearch服务不支持匿名请求(未使用有效的IAM凭据签名的请求)。
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/68205453
复制相关文章
相似问题
腾讯云开发者
