AWS Elasticsearch Service Access Policy Terraform Template

access_policy.template

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "es:ESHttpGet",
        "es:ESHttpHead",
        "es:ESHttpPost",
        "es:ESHttpPut"
      ],
      "Resource": "arn:aws:es:${region}:*:domain/${domain_name}/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [${logstash_ips}]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "es:ESHttpGet",
        "es:ESHttpHead"
      ],
      "Resource": "arn:aws:es:${region}:*:domain/${domain_name}/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [${kibana_ips}]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "es:ESHttpPost",
      "Resource": "arn:aws:es:${region}:*:domain/${domain_name}/*/_msearch",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [${kibana_ips}]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "es:ESHttpDelete",
        "es:ESHttpGet",
        "es:ESHttpHead",
        "es:ESHttpPost",
        "es:ESHttpPut"
      ],
      "Resource": "arn:aws:es:${region}:*:domain/${domain_name}/.kibana-4/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [${kibana_ips}]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "es:ESHttpPost",
      "Resource": "arn:aws:es:${region}:*:domain/${domain_name}/.kibana-4",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [${kibana_ips}]
        }
      }
    }
  ]
}