I have made a whitelist policy containing list of IP address from where I want to get the IP
Sample below, consider Policy ARN is arn:aws:iam::0000000:policy/Whitelister
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Resource": "*",
"Condition": {
"NotIpAddress": {
"aws:SourceIp": [
"W.X.Y.Z",
"A.B.C.D"
]
}
}
}
]
}
I have an AWS Elasticsearch(ES) account, which allows JSON based access policy. How can I use the above policy in AWS ES' policy to restrict access to these IPs only.
I have hard written IPs now, but that will cause redundancy and updating the IPs will be difficult.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": "*",
"Action": "*",
"Resource": [
"arn:aws:es:****************/domain-name/*",
"arn:aws:es:****************/domain-name/"
],
"Condition": {
"NotIpAddress": {
"aws:SourceIp": [
"W.X.Y.Z",
"A.B.C.D"
]
}
}
}
]
}
Unfortunately, you can't use your policy in IP policy for an ES domain.
Let me elaborate a bit on this, as I think there is a confusion between resource-based policies, such as IP policies for the ES domain, and identity-based policies for IAM users, roles or groups. The differences are explained in the AWS docs.
In short, you policy arn:aws:iam::0000000:policy/Whitelister is, so called, managed-policy. The managed polices can only be attached to IAM identity which can be IAM user, group or role. They can't be attached to resource-based policies.