I created an Elastic Search cluster on AWS and I need to configure access control. I have an Amplify app that has a custom Lambda which will verify the incoming request based on user and cross check in Cognito if that user exists. Then only fetch documents from ES cluster that match a specific field name for this specific user. I saw there is configuration available when launching ES cluster in management console like Amazon Cognito authentication. Is that what I need, or do I need Custom access policy or JSON defined access policy? I dont want public access to ES.
Related
Im using aws cognito and php sdk for user authentication and on website I want to list all the user names from cognito since I didn't saved the names in the database. The problem is I don't have aws key id and secret id. But i have pool id, client id and client secret key. Is there any way to fetch the details?
You need some kind of access with AWS Cognito rights. From client side you can't query all the users so you have to query them from server-side. Good part that you're using PHP SDK. If your PHP application is running on any AWS compute service like EC2 or Lambad then you don't need IAM Access Keys. You can use IAM Roles and attach the role with the services (EC2, Lambda, etc.) IAM roles behave same as Access Keys.
Sample code to list users in PHP can be found in the documentation below:
https://docs.aws.amazon.com/aws-sdk-php/v3/api/api-cognito-idp-2016-04-18.html#listusers
The recently added SAML support for AWS Elastic Search solution:
https://aws.amazon.com/about-aws/whats-new/2020/10/amazon-elasticsearch-service-adds-native-saml-authentication-kibana/
Lists in its documentation that backend roles are supported:
https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/saml.html
In Okta, for example, you might have a user, jdoe, who belongs to the group admins. If you add jdoe to the SAML master username field, only that user receives full permissions. If you add admins to the SAML master backend role field, any user who belongs to the admins group receives full permissions.
If you want to use backend roles (recommended), specify an attribute from the assertion in the Role key field, such as role or group. This is another situation in which tools like SAML-tracer can help.
But some users have problems finalizing the configuration once they are done with the AWS Console.
The answer lies beyond the AWS Console and must be completed within the Elastic Search cluster with the Master User that you created either within the cluster as an Internal User, via an IAM role or by using the Master User field in the SAML configuration section of the Modify Authentication Wizard in the AWS console for Elastic Search.
You must:
Create a Backend role that matches your SAML attribute value
Create a Mapping between the new backend role and an actual Elastic Search Role
After you're done configuring your IdP by creating a custom Attribute/Claim like roles or groups and after you've configure SAML authentication integration in the Elastic search cluster.
1.-Log into Kibana using your master user
2.-Go to OpenDistro -> Security -> Roles -> The Role you want to grant access to, i.e. readall
3.-Go to the Mapped Users tab under the role screen
4.-On the Backend Roles field type the VALUE of the Azure Claim you created by following these steps: https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-enterprise-app-role-management
For reference the claim value is: user.assignedroles.
The claim key is whatever you configure your Azure Enterprise application as.
You'll have a key value pair of "Your chosen Claim Name": user.assignedroles
5.-Save the Mapping in Kibana
Using the Azure IdP log into Kibana using users with different Azure Claim assigned to them. The Open Distro Security plugin will parse the SAML token attribute find the field for user.assignedroles and map that as a Kibana Backend Role to the actual Elastic Search roles.
I have an AWS Elasticsearch instance with a Kibana link that I want to share with another person, so that they can access this data from their browser. How can I allow them access?
This blog post does a great job of describing the options available to you for controlling access to Amazon ElasticSearch.
You can use identity federation via Cognito User Pools.
Resource based policy: Explicitly allow access to the cluster for a given IAM user ID in the ElasticSearch policy.
User based policy: Explicitly grant that IAM user's role access to the ARN of your ES cluster
Put your ES service behind a proxy with authentication
This SO question/answers go into more depth, with various high quality answers: How to access Kibana from Amazon elasticsearch service?
I have created aws - elasticsearch instance in aws. It has a link of kibana. I want to give access to specific person.Such that only that person can access that link .What can I do?
I can allow IP specific access but that is very generic and IP keeps changing every time.
You can find a walkthrough on the AWS blog to use Cognito for access control to Kibana on AWS ElasticSearch, complete with IAM policy samples and AWS console screenshots showing you where to click.
The summary is this:
Create a user pool in Amazon Cognito
In the ElasticSearch console, select the checkbox for "Enable Amazon Cognito for authentication" and tell it to use your user pool.
Create a Cognito user and a group which you will use to access Kibana
Update the policy on your ES cluster to allow members of the Cognito User pool to assume an Auth role for the ES cluster.
I am setting up our telephony system in AWS and we're utilizing AWS Single Sign On for our primary SAML authentication. This has worked fine for normal cli and console access but has kind of been a struggle for implementing Amazon Connect through the SSO Cloud Applications configuration.
Background
I have done a proof of concept with a single Amazon Connect instance and was able to federate login with a number of different permissions sets to simulate admin, developer, and user access for the single instance. This worked fine until I started adding additional instances and each time any user permission set tries to login to Amazon Connect they get Session Expired on the Connect screen.
Our setup is as follows:
Root account contains AWS SSO Directory
Dev Account has 1 Connect instance in the east
QA Account has 2 Connect instances total in east and west
Prod account has 2 Connect instances total in east and west
A lot of the documentation I've been reading seems it assumes the Amazon Connect instances are in the same account as the Amazon SSO service. Additionally the documentation mentions creating additional IAM Identity Providers for each Amazon Connect instance's SAML Metadata file, and a role associated that allows the SSO user to access that instance. I see where this would work in a single account, but I don't understand how to adopt the access role and implement it as a permissions policy in AWS SSO for the user group thats logging into the instance.
I've configured everything as close as possible to the Amazon Connect SAML Setup Guide, and I'm working on troubleshooting the permissions policy stuff to configure access, I'm just at a loss.
If anyone has previous Amazon SSO experience, or has done something similar with Amazon Connect that would be greatly appreciated. I just want to be able to validate whether this is feasible in the current iteration of Amazon SSO (granted its a newer service), or we need to architect and integrate a 3rd party SSO for Amazon Connect.
Thanks!
We recently have this kind of setup and requirements and still in the testing phase but so far, it is working as expected.
In the Amazon Connect SAML Guide that you linked, there's a lacking piece of information in there with regards to the Attributes Mapping (Step 10)
Change From:
Field: https://aws.amazon.com/SAML/Attributes/Role
Value:
arn:aws:iam::<12-digit-account_id>:saml-provider/,arn:aws:iam::<12-digit-account_id>:role/
To This:
Field: https://aws.amazon.com/SAML/Attributes/Role
Value:
arn:aws:iam::ACCOUNT-ID:saml-provider/IDP_PROVIDER_NAME,arn:aws:iam::ACCOUNT-ID:role/ROLE_NAME
Sample Value:
arn:aws:iam::123456301789:saml-provider/AWSSSO_DevelopmentConnect,arn:aws:iam::123456301789:role/AmazonConnect_Development_Role
The Setup:
Root AWS
Configured with AWS SSO
In AWS SSO page, you can have 1 or more Amazon Connect Applications here
AmazonConnect-Development
AmazonConnect-QAEast
AmazonConnect-QAWest
Dev AWS:
You have setup Amazon Connect
AmazonConnect-Development as the Instance Name (Record the ARN)
Create a new Identity Provider (for ex: AWSSSO_DevelopmentConnect)
Create a Policy (to be attached in the Role)
Create a Role (for ex: AmazonConnect_Development_Role)
See more here for the content of Policy
In Root AWS, configure your AmazonConnect-Development application to have the Attribute Mapping pattern same with my above example value.
You also specify the Relay State URL for you want the users to be redirected to a specific Amazon Connecct application.
xxx AWS:
Same steps will be applied as the above
Key Points:
For each AWS Account:
You will need to Create Identity Provider, name it with a pattern
Create a Policy to be attached in the Role
Create a Role and Choose SAML 2.0 Federation
Checked: Allow programmatic and AWS Management Console access
Link the Identity Provider with the Role
For the Applications that you configure in the AWS SSO page, make sure the additional Attribute Mappings have the correct value