Securely Connect to AWS Elasticsearch from Nextjs Serverless Functions

Question

I am trying to securely connect to my ES service from the serverless functions in Nextjs. The serverless functions have no fixed IP address or IP address range so I can't secure it that way. I have tried creating an IAM User and using the access key ID and secret access key to create the basic authorization header like this.

const auth = btoa(`${accessKey}:${accessSecret}`);

Then I used that as the Authorization header like this.

`Authorization: Basic ${auth}`

The request comes back with the following error.

{
    "message": "Authorization header requires 'Credential' parameter. Authorization header requires 'Signature' parameter. Authorization header requires 'SignedHeaders' parameter. Authorization header requires existence of either a 'X-Amz-Date' or a 'Date' header. Authorization=Basic XXXXXXXXXXXXXXXXXXXXXXXXXX"
}

I have given the IAM user permission through the access policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::XXXXXXXXX:user/elasticsearch"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:us-east-2:XXXXXXXX:domain/team-up/*"
    }
  ]
}

Is this the right way to secure the connection to the database? I have tried setting up a password on the database using the POST /_security/user/_password endpoint, but that fails too.

Amazon claims that basic authorization is supported. https://aws.amazon.com/elasticsearch-service/faqs/

Answer 1

I didn't create a master user during the wizard setup of the aws elasticsearch domain. Once the domain is created there is no way to create a master user it seems. I deleted the elasticseach domain and recreated it with a master user.

I followed this guide. https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/fgac.html#fgac-walkthrough-basic