Add aws lambda permissions to aws elasticsearch policy - amazon-web-services

Question

I added the following IP access restriction to my aws elasticsearch access policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "es:*",
"Resource": "arn:aws:es:us-west-2:000000000000:domain/tst/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": [
"XX.XX.XX.XX"
]
}
}
}
]
}
I have a lambda function and a kinesis firehouse reading and writing the elasticsearch index. How could I add lambda and kenesis firehouse permisions to my elasticsearch access policy?

Answer 1

Finally I solved as follows:
Adding the following policy to aws elasticsearch:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<account-id>:user/admin"
},
"Action": "es: *",
"Resource": "example-domain.us-east-1.es.amazonaws.com:<account-id>:domain/ *"
},
{
"Effect": "Allow",
"Principal": {
"AWS": " * "
},
"Action": "es:*",
"Resource": "example-domain.us-east-1.es.amazonaws.com:<account-id>:domain/ *",
"Condition": {
"IpAddress": {
"aws:SourceIp": "<my-ip>"
}
}
}
]
}
Adding at the IAM user with the security credentials the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "elasticsearchFullAccess",
"Effect": "Allow",
"Action": [
"es: *"
],
"Resource": [
"arn:aws:es:us-east-1:<account-id>:domain/ *"
]
}
]
}
Sign requests using this.
I solved this thanks to this question