通过 Cloud Formation 创建 Amazon Elasticsearch Service 时 CloudWatch 资源访问策略错误

Question

我正在尝试创建一个启用了LogPublishingOptions. 虽然启用 LogPublishingOptions ES 表示它没有足够的权限在 Cloudwatch 上创建 LogStream。

我尝试创建一个带有角色的策略并将该策略附加到 ES 引用的 LogGroup，但它不起作用。以下是我的弹性搜索云形成模板，

AWSTemplateFormatVersion: 2010-09-09

Resources:
  MYLOGGROUP:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: index_slow

  MYESROLE:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: es.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonESFullAccess'
        - 'arn:aws:iam::aws:policy/CloudWatchFullAccess'
      RoleName: !Join
        - '-'
        - - es
          - !Ref 'AWS::Region'

  PolicyDocESIndexSlow :
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: 
             - logs:PutLogEvents
             - logs:CreateLogStream
            Resource: 'arn:aws:logs:*'
      PolicyName: !Ref MYLOGGROUP
      Roles:
        - !Ref MYESROLE

  MYESDOMAIN:
    Type: AWS::Elasticsearch::Domain
    Properties:
      DomainName: 'es-domain'
      ElasticsearchVersion: '7.4'
      ElasticsearchClusterConfig:
        DedicatedMasterCount: 3
        DedicatedMasterEnabled: True
        DedicatedMasterType: 'r5.large.elasticsearch'
        InstanceCount: '2'
        InstanceType: 'r5.large.elasticsearch'
      EBSOptions:
        EBSEnabled: True
        VolumeSize: 10
        VolumeType: 'gp2'
      AccessPolicies:
        Version: 2012-10-17
        Statement:
          - Effect: Deny
            Principal:
              AWS: '*'
            Action: 'es:*'
            Resource: '*'
      AdvancedOptions:
        rest.action.multi.allow_explicit_index: True
      LogPublishingOptions:
        INDEX_SLOW_LOGS:
          CloudWatchLogsLogGroupArn: !GetAtt
            - MYLOGGROUP
            - Arn
          Enabled: True
      VPCOptions:
        SubnetIds:
          - !Ref MYSUBNET
        SecurityGroupIds:
          - !Ref MYSECURITYGROUP
  MYVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  MYSUBNET:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MYVPC
      CidrBlock: 10.0.0.0/16
  MYSECURITYGROUP:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: security group for elastic search domain
      VpcId: !Ref MYVPC
      GroupName: 'SG for ES'
      SecurityGroupIngress:
        - FromPort: '443'
          IpProtocol: tcp
          ToPort: '443'
          CidrIp: 0.0.0.0/0

执行时，它会创建除 MYESDOMAIN 之外的所有资源。它说

为 CloudWatch Logs 日志组 index_slow 指定的资源访问策略没有为 Amazon Elasticsearch Service 授予足够的权限来创建日志流。请检查资源访问策略。（服务：AWSElasticsearch；状态代码：400；错误代码：ValidationException）

知道这里缺少什么吗？

Answer 1

2021 年更新

有一个名为 CloudFormation 的资源AWS::Logs::ResourcePolicy，它允许在 CF 中定义 CloudWatch Logs 的策略。我发现的主要问题是它只接受真实的字符串作为值。尝试使用 Ref、Join 等组合字符串一直被拒绝。如果有人能做到这一点那就太好了。

用 YAML 编写更容易，因为 JSON 需要转义所有字符"。

OSLogGroupPolicy:
    Type: AWS::Logs::ResourcePolicy
    Properties:
      PolicyName: AllowES
      PolicyDocument: '{"Version": "2012-10-17","Statement":[{"Effect":"Allow","Principal": {"Service": ["es.amazonaws.com"]},"Action":["logs:PutLogEvents","logs:CreateLogStream"],"Resource":"*"}]}'

Answer 2

我相信对于应该更新/设置哪些策略以启用 ES 写入日志组存在一些困惑。

我认为您应该将该PolicyDocESIndexSlow策略应用于CloudWatch Logs。

据我所知，这不能在 CloudFormation 中完成。您必须使用put-resource-policy、相应的 API 调用或控制台，如下所示：

• 查看 Amazon Elasticsearch Service 慢速日志