AWS托管旧版Elasticsearch配置S3快照备份报权限403错误

配置错误排查与修正方案 #

已发现的明确配置问题 #

• IAM权限分配错误：iam:PassRole 是调用ES API的身份（你Python脚本中使用的AK对应IAM用户）需要的权限，不应该配置在ES服务关联角色的权限策略中；同理 es:ESHttpPost 是调用ES API的身份需要的权限，放在ES服务角色里无效。
• 桶名大小写不匹配：Python脚本中填写的桶名是qa-MYCOMPANYNAME-elasticsearch-backups，IAM策略中写的是全小写的qa-mycompanyname-elasticsearch-backups，S3桶名全局唯一且全小写，IAM资源匹配大小写敏感，该问题是触发403的核心原因之一。
• 调用方权限缺失：你使用的AK对应的IAM用户没有配置PassRole权限，ES服务无法正常获取关联角色的权限访问S3。

分步修正方案 #

1. 修正ES服务关联角色QA-elasticsearch-instance-role的权限策略，移除无效配置：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListS3BackupBucket",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::qa-mycompanyname-elasticsearch-backups"
        },
        {
            "Sid": "AllowBackupStorage",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::qa-mycompanyname-elasticsearch-backups/*"
        }
    ]
}

该角色的信任关系配置正确，无需修改。

2. 给Python脚本中使用的AK对应的IAM用户附加如下权限策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::MYACCOUNTID:role/QA-elasticsearch-instance-role"
        },
        {
            "Effect": "Allow",
            "Action": "es:ESHttpPut",
            "Resource": "arn:aws:es:us-east-1:MYACCOUNTID:domain/qa-elasticsearch/_snapshot/*"
        }
    ]
}

3. 修正Python脚本中的桶名为全小写，和IAM策略保持一致：

payload = {
    "type": "s3",
    "settings": {
        "bucket": "qa-mycompanyname-elasticsearch-backups",
        "region": "us-east-1",
        "role_arn": "arn:aws:iam::MYACCOUNTID:role/QA-elasticsearch-instance-role"
        # 如果你的S3桶开启了服务端加密，额外加下面一行
        # "server_side_encryption": true
    }
}

4. 可选补充配置：如果S3桶开启了KMS默认加密，需要给ES服务关联角色额外加KMS访问权限：

{
    "Sid": "AllowKMSAccessForSSE",
    "Effect": "Allow",
    "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
    ],
    "Resource": "你S3桶加密使用的KMS密钥ARN"
}

内容的提问来源于stack exchange，提问作者DrTeeth