Question

0

103

Views

Signing ElasticSearch AWS calls

I'm attempting to sign all of our AWS calls to ElasticSearch however the response is always;

User: anonymous is not authorized to perform: es:ESHttpGet on resource:

I've tried multiple key pairs and IAM users.

The calls within our PHP are made using the official elasticsearch-php client and all requests are signed using the connector found here.

Shown below is how we build the ElasticSearch client and apply signing middleware;

$credentials = new Credentials('<KEY>', '<SECRET>');
$signature = new SignatureV4('es', 'eu-central-1');

$middleware = new AwsSignatureMiddleware($credentials, $signature);
$defaultHandler = ESClientBuilder::defaultHandler();
$awsHandler = $middleware($defaultHandler);

$clientBuilder =  ESClientBuilder::create();

$clientBuilder
    ->setHandler($awsHandler)
    ->setHosts(['<URL>']);
$this->_client = $clientBuilder->build();

For reference the policy attached to the elasticsearch instance we are trying to access is;

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<IAM_USER>"
      },
      "Action": "es:*",
      "Resource": "<RESOURCE>/*"
    }
  ]
}

Other info;

We are using the Laravel framework, version 5.4.7
Elasticsearch client version 5.3.2

over 4 years ago · Santiago Trujillo

2 answers

Answer question

0

Answer question

Find remote jobs

Answer 1 · 2022-05-17T16:56:57.272Z

It is hard to answer anything specific without a complete understanding of what is happening with the particular request, but here are some suggestions on where to start the search for solution.

There might be a problem with the middleware. I found another one, which seems to be cleaner and better tested. I would suggest trying it out - amazon-es-php
There might be an issue with your policies / VPC configuration, so make sure to check this page for possible problematic places
Another option is to enable loggin for your elasticsearch php client to shed some light onto what is going on with the requests. This can be done by adding monolog library to your application and creating a logger handler. Here is a guide from the official elastic search documentation.

Answer 2 · 2022-05-17T16:56:57.285Z

This helped me when I had similar issue :

To troubleshoot this issue, check the following:

Verify that you are using a client that supports credential signing, and that your requests are being signed correctly. AWS uses the Signature Version 4 Signing Process to add authentication information to AWS requests; requests from clients that aren’t compatible with Signature Version 4 are rejected with an ‘anonymous is not authorized’ error. For examples of well-formed requests to Elasticsearch, see Signing an Amazon Elasticsearch Service Search Request.

Verify that the users and resources specified in the access policy have the correct Amazon Resource Name (ARN) specified. For general information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces.

Ensure that IP addresses specified in the access policy use CIDR notation. Access policies use CIDR notation when checking your IP address against the IP addresses specified by the policy.

Verify that the IP addresses specified in your access policy match the IP addresses you are using to access your Elasticsearch cluster. Your IP may have changed since the access policy was originally configured. You can determine the public-facing IP address of any instance at http://checkip.amazonaws.com/.

Review Troubleshoot IAM Policies for additional troubleshooting information.

For more details check this out...

0

103

Signing ElasticSearch AWS calls

2 answers

0

0

Find remote jobs

Andres GPT