AWS Elasticsearch Service not authorized to perform scroll - amazon-web-services

Question

I'm trying to use elasticdump to copy indexes from AWS Elasticsearch Service:
elasticdump --input=https://xxx.xx-xxx-x.es.amazonaws.com/my_index --output=my_index.json
The relevant part of the policy:
...
"Action": "es:*",
"Resource": [
"arn:aws:es:xx-xxx-x:XXXXXXXX:domain/escluster/*",
"arn:aws:es:xx-xxx-x:XXXXXXXX:domain/escluster",
"arn:aws:es:xx-xxx-x:XXXXXXXX:domain/escluster/_search/scroll"
]
...
After 100 objects, I get:
{"Message":"User: anonymous is not authorized to perform: es:ESHttpGet on resource: arn:aws:es:xx-xxx-x:XXXXXXXX:domain/escluster/_search/scroll"}
Why does AWS prevent me from scrolling?

Answer 1

You might need add the IP for the machine which will access the ES to make the dump
I had similar issue and adding the IP fixed my problem
My policy is something like this:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<AWSACCOUNT>:root"
},
"Action": "es:*",
"Resource": "arn:aws:es:us-west-1:<AWSACCOUNT>:domain/<domain>/*"
},
{
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "*",
"Resource": [
"arn:aws:es:<AWSACCOUNT>:domain/<domain>/*",
"arn:aws:es:<AWSACCOUNT>:domain/<domain>/_search/scroll"
],
"Condition": {
"IpAddress": {
"aws:SourceIp": [
<IP1>,
<IP2>,
<...>
]
}
}
}
]
}
and maybe you need set the port in your command line