跨AWS账号调用ES遇权限错误：Lambda（账号B）无法执行es:ESHttpPost

问题分析 #

报错信息明确指出：账号B中Lambda使用的lambdaRole角色无权限执行es:ESHttpPost，核心原因是ES集群的资源策略未授权该角色操作。你之前添加的账号B root用户权限不生效，因为Lambda实际以角色身份发起请求，而非root用户。

解决步骤 #

1. 修正ES集群的资源策略 #

将账号B中Lambda使用的角色ARN直接加入ES资源策略，替换原有的账号B root权限条目即可。

单角色授权示例（替换为你的实际ARN）

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AccountB:role/lambdaRole"
      },
      "Action": "es:ESHttpPost",
      "Resource": "arn:aws:es:us-east-1:AccountA:domain/domainName/*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-east-1:AccountA:domain/domainName/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "你的IP地址列表"
          ]
        }
      }
    }
  ]
}

多角色授权示例（允许账号B下所有角色访问）

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AccountB:root"
      },
      "Action": "es:ESHttpPost",
      "Resource": "arn:aws:es:us-east-1:AccountA:domain/domainName/*",
      "Condition": {
        "ArnLike": {
          "aws:PrincipalArn": "arn:aws:iam::AccountB:role/*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-east-1:AccountA:domain/domainName/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "你的IP地址列表"
          ]
        }
      }
    }
  ]
}

2. 配置Lambda角色的IAM策略 #

账号B中Lambda的lambdaRole角色需在IAM策略里明确允许访问ES的es:ESHttpPost操作：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "es:ESHttpPost",
      "Resource": "arn:aws:es:us-east-1:AccountA:domain/domainName/*"
    }
  ]
}

3. 验证权限 #

修改策略后等待1-2分钟让AWS权限同步，再触发Lambda测试是否能正常访问ES集群。

内容的提问来源于stack exchange，提问作者Deepak Gopidalai