CODEWITHSUNDEEP
springamazon-web-servicesspring-bootelasticsearchelasticsearch-jest
E. Lion
E. Lion

Reputation: 668

Error the request signature. AWS ElasticSearch

When I want to delete an item from the index, it fails and shows us the next trace of ERROR:

org.springframework.data.elasticsearch.ElasticsearchException: Cannot execute jest action , response code : 403 , error : 403 Forbidden , message : The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

I have created a "removeBy..." method in the ElasticsearchRepository repository to remove items from our index:

public interface IndexSynonymRepository extends ElasticsearchRepository<IdxSynonym, Long> {
    void removeByIdDashboardAndIdTable(Long idDashBoard, Long idTable);
}

The versions incorporated into my JAVA project are the following: POM configuration versions:

<!-- Spring Data Jest ElasticSearch AWS -->
<dependency>
    <groupId>com.github.vanroy</groupId>
    <artifactId>spring-boot-starter-data-jest</artifactId>
    <version>2.3.1.RELEASE</version>
</dependency>

<!-- Spring Data ElasticSearch -->
<dependency>
    <groupId>org.springframework.data</groupId>
    <artifactId>spring-data-elasticsearch</artifactId>
    <version>2.1.1.RELEASE</version>
</dependency>

<!-- Jest -->
<dependency>
    <groupId>io.searchbox</groupId>
    <artifactId>jest</artifactId>
    <version>2.0.4</version>
</dependency>

<!-- ElasticSearch -->
<dependency>
    <groupId>org.elasticsearch</groupId>
    <artifactId>elasticsearch</artifactId>
    <version>2.4.4</version>
</dependency>

<!-- Spring Boot -->
<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>1.5.2.RELEASE</version>
    <relativePath />
    <!-- lookup parent from repository -->
</parent>

<!-- Aws Signing Request Interceptor -->
<dependency>
    <groupId>vc.inreach.aws</groupId>
    <artifactId>aws-signing-request-interceptor</artifactId>
    <version>0.0.20</version>
    <scope>compile</scope>
    <exclusions>
      <exclusion>
          <artifactId>*</artifactId>
          <groupId>com.amazonaws</groupId>
      </exclusion>
    </exclusions>
</dependency>

The roles policies that we have configured in AWS are the following:

Access Policy ElasticSearch:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "es:*", "Resource": [ "arn:aws:es:us-east-1:XXXXXXXXXXXX:domain/my-domain/*", "arn:aws:es:us-east-1:XXXXXXXXXXXX:domain/my-domain" ] } ] }

EC2 Role Policy:

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "es:*" ], "Resource": [ "arn:aws:es:us-east-1:XXXXXXXXXXXX:domain/my-domain", "arn:aws:es:us-east-1:XXXXXXXXXXXX:domain/my-domain/*" ], "Effect": "Allow" } ] }

I do not know if it is a problem of permits or if I have made an error in signing the application.

I need help to solve this problem. Thank you very much in advance.

Upvotes: 2

Views: 1442

Answers (1)

bertie
bertie

Reputation: 503

When VPC access is configured, is not necessary the aws-signing-request-interceptor when use the ES Access Policy template:

enter image description here

You can configure access through ES Security Group. You should add an inbound rule like this:

Type: HTTPS
Protocol: TCP
Port: 443
Source: sg-abcdefghijklmno (Your EC2 instance Security group)

Hope this helps

Upvotes: 1

Related Questions