Terraform, ElasticSearch: Error: InvalidTypeException: Error setting policy

Question

I would like to attach the access policy below to the ElasticSearch:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "${resource_arn}/*"
    }
  ]
}

I added line iam_role_arns = ["*"], but I got error below:

module.elasticsearch.aws_elasticsearch_domain_policy.default[0]: Creating...
Error: InvalidTypeException: Error setting policy:

Here is the code:

module "elasticsearch" {
  source                  = "git::https://github.com/cloudposse/terraform-aws-elasticsearch.git?ref=tags/0.24.1"
  security_groups                = [data.terraform_remote_state.vpc.outputs.default_security_group_id]
  vpc_id                         = data.terraform_remote_state.vpc.outputs.vpc_id
  zone_awareness_enabled         = var.zone_awareness_enabled
  subnet_ids                     = slice(data.terraform_remote_state.vpc.outputs.private_subnets, 0, 2)
  elasticsearch_version          = var.elasticsearch_version
  instance_type                  = var.instance_type
  instance_count                 = var.instance_count
  encrypt_at_rest_enabled        = var.encrypt_at_rest_enabled
  dedicated_master_enabled       = var.dedicated_master_enabled
  create_iam_service_linked_role = var.create_iam_service_linked_role
  kibana_subdomain_name          = var.kibana_subdomain_name
  ebs_volume_size                = var.ebs_volume_size
  dns_zone_id                    = var.dns_zone_id
  kibana_hostname_enabled        = var.kibana_hostname_enabled
  domain_hostname_enabled        = var.domain_hostname_enabled
  allowed_cidr_blocks            = ["0.0.0.0/0"]
  iam_role_arns                  = ["*"]
  advanced_options = {
    "rest.action.multi.allow_explicit_index" = "true"
  }
  context = module.this.context
}

Marcin · Accepted Answer · 2020-12-12 05:23:54Z

2

You can't create such an open access policy since your ES domain is in VPC. As explain in terraform-aws-elasticsearch source code comments, open access policy is only for IP range and non-VPC ES domains:

This statement is for non VPC ES to allow anonymous access from whitelisted IP ranges without requests signing

Just for completeness the use of

  allowed_cidr_blocks            = ["0.0.0.0/0"]
  iam_role_arns                  = ["*"]

should not result in policy error. In fact, it should produce the following (I tested on my ES domain):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "*",
          "arn:aws:iam::xxxx:role/es-name"
        ]
      },
      "Resource": [
        "arn:aws:es:us-east-1:xxxxx:domain/es-name/*",
        "arn:aws:es:us-east-1:xxxx:domain/es-name"
      ]
    }
  ]
}

answered Dec 12, 2020 at 5:23

Marcin

241k16 gold badges315 silver badges368 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

holms Over a year ago

I've got error message MalformedPolicyDocument: Policy document should not specify a principal.

Sharique Masood · Accepted Answer · 2021-07-21 08:04:16Z

0

you might be doing jasonencode while passing json policy file to module, if yes try passing policy file directly without any encoding. Eg: file("policy.json")

answered Jul 21, 2021 at 8:04

Sharique Masood

1845 bronze badges

1 Comment

Elydasian Over a year ago

Please provide a detailed explanation to your answer, so that the next user could make better understand your answer.

Collectives™ on Stack Overflow

Terraform, ElasticSearch: Error: InvalidTypeException: Error setting policy

2 Answers 2

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related