If lambda can access the elasticsearch with in sam

问题:

within same VPC, If lambda can access the elasticsearch without applying IAM role? Is this possible?

回答1:

You need to provide an IAM role for a lambda function and provide the IAM role access to ES.

回答2:

If your Lambda runs within a VPC, you can configure the ElasticSearch access policy to an IP-based policy.

AWS does provide samples for various kinds of access policies.

IP based access policy

回答3:

You will want to configure two Security Groups:

• Configure the Lambda function to use the VPC.
• Create a Lambda Security Group (Lambda-SG) and configure the Lambda function to use it.
• Create an ElasticSearch Security Group (ES-SG) and configure ElasticSearch to use it.
• In ES-SG, add a rule to permit inbound connections from Lambda-SG on port 9300 (or whatever port your ES is using).

That is, ES-SG should refer to Lambda-SG to permit inbound connections.