Securing AWS Elasticsearch best practices - amazon-web-services

Question

I currently working on a web project. We are trying to use elastic search. Our all web projects and other tools currently hosting on Amazon.
We just create an EC2 instance for Elastic search, Log Stash, and kibana. After that, we configured Elastic search. We're successfully using elastic search for our purposes.
But there is a problem way the communicating with elastic search and our Web APIs.
Our servers auto-scaling so we configured elastic search for IP security like below.
So we are currently suffocating because of auto-scaling. IPs changing time to time. How can we configure our Elastic Search for using from our Web API servers? What are the best practices for this situation?
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "es:*",
"Resource": "arn:aws:es:eu-west:1111111111:domain/xx-log/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": [
"1.1.1.1",
"1.1.1.2",
"1.1.1.3",
...
]
}
}
}
]
}

Answer 1

Your best bet is to create an iam role, and then in your launch configuration set that role as the "IAM role". http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
And then after use a policy that allows the AWS role and some specific IPs access to your elasticsearch domain.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::ACCOUNTNUMBER:role/ROLENAME"
},
"Action": [
"es:ESHttpGet",
"es:ESHttpHead",
"es:ESHttpPost",
"es:ESHttpPut"
],
"Resource": "arn:aws:es:ca-central-1:ACCOUNTNUMBER:domain/ELASTICSEARCHDOMAINNAME/*"
},
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"es:ESHttpGet",
"es:ESHttpHead",
"es:ESHttpPost",
"es:ESHttpPut"
],
"Resource": "arn:aws:es:ca-central-1:ACCOUNTNUMBER:domain/ELASTICSEARCHDOMAINNAME/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "IPADDRESSHERE"
}
}
}
]
}