AWS ES IAM policy allows both IP access (Kibana proxy) and resource (EC2) access

elasticsearch-iam-policy.json

{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Resource": "arn:aws:es:us-east-1:<account_id>:domain/<es_domain>/<es_index|*>",
   "Principal": {
        "AWS": "arn:aws:iam::<account_id>:role/<iam_role>"
   },
   "Action": ["es:*"],
   "Effect": "Allow",
   "Sid": "IAMRoleResourceFullAccess"
  },
  {
   "Sid": "KibanaProxyIPReadAccess",
   "Effect": "Allow",
   "Principal": {
     "AWS": "*"
   },
   "Action": "es:ESHttpGet",
   "Condition": {
     "IpAddress": {
       "aws:SourceIp": [
         "AAA.BBB.CCC.DDD"
       ]
     }
   },
   "Resource":
    "arn:aws:es:us-east-1:<account_id>:domain/<es_domain>/<es_index|*>"
  }
 ]
}