基于VPC的Kibana通过AWS Cognito访问问题求助

Hey Martin, since you're new to AWS and hitting this Kibana blank page issue with Cognito, let's walk through your questions clearly:

1. Is your requirement feasible? #

Absolutely. AWS supports using Cognito to authenticate access to Kibana even when your Elasticsearch cluster is deployed inside a VPC. The blank page you're seeing is almost certainly a network or configuration issue (not a fundamental limitation), so we can fix that.

2. Do you need to use VPN to see the login page? #

No, you don't have to use VPN—but here's why you're seeing a blank page right now:

• Your Elasticsearch cluster is in a VPC, so its endpoint is private by default. When you try to access it directly from outside the VPC, your browser can't reach the Kibana static resources (CSS, JS, etc.), leading to a blank screen.
• VPN would let you access the private endpoint, but it's not the only way to get external access to Kibana.

3. How to open Kibana to external users without VPN? #

The most reliable, secure approaches are:

Option 1: Use an Application Load Balancer (ALB) as a reverse proxy (recommended) #

ALBs are managed by AWS, integrate natively with Cognito, and keep your Elasticsearch cluster safely inside the VPC. Here's the high-level setup:

• Deploy an ALB in your VPC's public subnets, listening on HTTPS (Kibana requires secure connections).
• Create a target group pointing to your Elasticsearch cluster's private endpoint (port 443).
• Enable Cognito authentication on the ALB's listener: link your existing Cognito user pool and identity pool, so users are redirected to the Cognito login page before accessing Kibana.
• Update your Elasticsearch access policy to allow traffic from the ALB's security group, and grant permissions to the Cognito authenticated role to access ES/Kibana resources.
• Configure Kibana's x-pack settings (via Elasticsearch cluster settings) to use Cognito for authentication—make sure you set parameters like xpack.security.authc.providers.cognito.user_pool_id, xpack.security.authc.providers.cognito.identity_pool_id, and your AWS region.

Option 2: Use EC2 as a custom reverse proxy (e.g., Nginx) #

If you prefer more control, you can deploy an EC2 instance in a public subnet as an Nginx proxy. You'll need to:

• Configure Nginx to forward traffic to your Elasticsearch private endpoint.
• Set up SSL termination on Nginx (using AWS Certificate Manager certificates is easy).
• Integrate Nginx with Cognito using OpenID Connect (OIDC) to handle authentication before forwarding requests.
• This requires more maintenance than using an ALB, but it's flexible for custom use cases.

Option 3: Avoid exposing ES directly to the public #

Never place your Elasticsearch cluster in a public subnet—this exposes it to unnecessary security risks. Even with Cognito, keeping it in a private subnet behind a proxy is the best practice.

4. Is reverse proxy + Cognito a better solution? #

Yes, this is the recommended approach for your use case. Using an ALB as the reverse proxy with native Cognito integration is the most efficient, low-maintenance option:

• It eliminates the need for VPN, letting external users access Kibana securely.
• Your Elasticsearch cluster stays protected in the VPC, with only the ALB exposed to the public.
• AWS manages the ALB's scaling, availability, and security patches, so you don't have to maintain extra infrastructure.

Quick fix for your current blank page #

If you want to test if your Cognito configuration works first, try accessing Kibana via VPN (to get into the VPC). If the login page loads and works, that confirms the issue is network-related, and setting up an ALB as above will solve it.

内容的提问来源于stack exchange，提问作者Martin