AWS Elasticsearch generate api-key
From comments:
Security API is part of x-pack which is not support yet by AWS Elasticserach service. if we need to use it with in AWS, using it as SAAS from AWS MarketPlace is an option. However, there are other options to secure AWS Elasticsearch:
- Using cognito to secure elastic, gives fine grained controls for users with identity pools and iam roles. Here are some details.
- IP based Resource polices. As long as clients are within network AWS/non-AWS, "*" principal with conditions restrict to cidr range. Anyone can access, no fine grained access for users within same ip cidr range.
- IAM Authentication: Gives fine grained control, needs AWS credentials via role(could be separate cognito too) or user cred, to sign the http requests with v4 signature. if we manually sign the http request, we can use aws4-sign, We just need to pass, service, region and body to
aws4.signmethod options in addition to nodejs http request options. Similar to example here with service ases. Couple of libraries which wraps this signing for elastic are aws-es-connection and http-aws-es