Implementéhttps://github.com/aws-samples/amazon-elasticsearch-service-with-cognito en mi pila y estoy tratando de agregar un grupo master según https://docs.aws.amazon.com/ elasticsearch-service/latest/developerguide/fgac.html#fgac-walkthrough-iam
Así que agregué a lo siguiente https://github.com/aws-samples/amazon-elasticsearch-service-with-cognito/blob/master/lib/search-stack.ts#L50
diff --git a/lib/search-stack.ts b/lib/search-stack.ts index 85de0c0..2493c92 100644 --- a/lib/search-stack.ts +++ b/lib/search-stack.ts @@ -3,7 +3,7 @@ import { Fn, Stack, Construct, StackProps, CfnParameter, CfnOutput } from '@aws-cdk/core'; import { CfnDomain } from '@aws-cdk/aws-elasticsearch'; -import { UserPoolAttribute, CfnUserPoolDomain, CfnIdentityPool, CfnIdentityPoolRoleAttachment, CfnUserPool } from '@aws-cdk/aws-cognito'; +import { UserPoolAttribute, CfnUserPoolDomain, CfnIdentityPool, CfnIdentityPoolRoleAttachment, CfnUserPool, CfnUserPoolGroup } from '@aws-cdk/aws-cognito'; import { Role, ManagedPolicy, ServicePrincipal, FederatedPrincipal } from '@aws-cdk/aws-iam'; import { CustomResource } from '@aws-cdk/aws-cloudformation'; @@ -55,6 +55,19 @@ export class SearchStack extends Stack { }, "sts:AssumeRoleWithWebIdentity") }); + // create two groups, one for admins one for users + + new CfnUserPoolGroup(this, "AdminsGroup", { + groupName: "master-user-group", + userPoolId: idPool.ref, + + }); + + new CfnUserPoolGroup(this, "UsersGroup", { + groupName: "limited-user-group", + userPoolId: idPool.ref, + }); + const esRole = new Role(this, "esRole", { assumedBy: new ServicePrincipal('es.amazonaws.com'), managedPolicies: [ManagedPolicy.fromAwsManagedPolicyName("AmazonESCognitoAccess")] ~¡pero después de volver a implementar los roles no se crean!
cualquier consejo es muy apreciado.
OK, necesitaba usar:
new CfnUserPoolGroup(this, "AdminsGroup", { groupName: "master-user-group", userPoolId: userPool.ref }); new CfnUserPoolGroup(this, "UsersGroup", { groupName: "limited-user-group", userPoolId: userPool.ref }); en lugar de idPool.ref
A partir de AWS CDK v1.91.0, use userPoolId en lugar de ref :
import * as cognito from '@aws-cdk/aws-cognito'; //... const userPool = new cognito.UserPool(this, 'UserPool', { //... }); new cognito.CfnUserPoolGroup(this, "ManagerGroup", { groupName: "manager", userPoolId: userPool.userPoolId });A partir de la versión 1.1.1, el código de amazon-elasticsearch-service-with-cognito incluye la configuración para un control de acceso detallado, incluido un grupo de Amazon Cognito llamado "es-admins" y la resolución de roles necesaria.