下面是我的serverless.yml文件中创建elasticsearch域的片段。如果我评论AccessPolicies部分,elasticsearch域已经创建,但是当我取消注释时它就失败了。我希望访问我的AWS帐户的资源,以访问elasticsearch服务。不知道是怎么回事。当我在堆栈溢出或谷歌中探索时,我发现了一些结果,但与地形有关。注意:我使用serverless-pseudo-parameters来引用serverless.yml中的变量。
EventsElasticsearchDomain:
Type: AWS::Elasticsearch::Domain
Properties:
ElasticsearchVersion: 7.4
DomainName: testevents
ElasticsearchClusterConfig:
InstanceCount: 1
InstanceType: m5.large.elasticsearch
ZoneAwarenessEnabled: false
EBSOptions: # its expected when we use m4 or m4 InstanceType
EBSEnabled: true
VolumeSize: 10
VolumeType: gp2
AccessPolicies:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
AWS: '#{AWS::AccountId}'
Action: 'es:ESHttp*'
Resource:
- arn:aws:es:#{AWS::Region}:#{AWS::AccountId}:domain/testevents/*误差
An error occurred: EventsElasticsearchDomain - Error setting policy:
[{"Version":"2012-10-17T00:00:00.000Z","Statement":[{"Action":"es:ESHttp*","Resource":["arn:aws:es:REGION:ACCNUMBER:domain/testevents/*"],"Effect":"Allow","Principal":{"AWS":"ACCNUMBER"}}]}]
(Service: AWSElasticsearch;
Status Code: 409; Error Code: InvalidTypeException; Request ID: xxxxxxxxxxx).发布于 2020-06-26 13:42:39
找到凶手了。它是我将版本作为日期对象而不是字符串。将Version: 2012-10-17更改为Version: '2012-10-17'解决了问题。
我们可以在错误消息:"Version":"2012-10-17T00:00:00.000Z"中注意到它。它将版本的值显示为日期字符串,而不是我发送的字符串。
发布于 2020-06-26 00:05:50
你在你的政策中了解到了!Sub和$:
Resource:
- !Sub "arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/testevents/*"同为
Principal:
AWS: !Sub "${AWS::AccountId}"https://stackoverflow.com/questions/62581777
复制相似问题