Elasticsearch:リソースグループによるきめ細かなアクセス制御

仕組み

リソースグループは、プロジェクトや環境ごとにリソースを整理します。リソースをグループ化したら、そのグループにのみ権限を限定する RAM ポリシーをアイデンティティ (RAM ユーザー、ユーザーグループ、ロールなど) にアタッチできます。詳細については、「リソースのグループ化と権限付与」をご参照ください。

このアプローチには、主に 2 つのメリットがあります。

• きめ細かなアクセス制御：アカウント全体の権限を付与する代わりに、アイデンティティのアクセスを特定のグループ内のリソースのみに制限できます。これにより、プロジェクト固有のワークロードを分離し、意図しないアクセスのリスクを軽減できます。

• 管理の簡素化：新しいリソースがリソースグループに追加されると、そのグループに限定された権限を持つ RAM アイデンティティは自動的にアクセスできます。新しいリソースが作成されるたびに RAM ポリシーを更新する必要はありません。

RAM ユーザーへのリソースグループレベルの権限付与

このセクションでは、特定のリソースグループ内のElasticsearchリソースにのみアクセス権限を RAM ユーザーに付与する方法について説明します。

サポート対象リソース

以下のElasticsearchリソースは、リソースグループレベルの権限付与をサポートしています。

サポート対象外アクション

以下のElasticsearchアクションは、リソースグループレベルの権限付与をサポートしていません。

上記のアクションについては、 [Resource Scope] を [Account] に設定し、カスタムポリシーを作成する必要があります。

以下のポリシー例は、必要に応じてカスタマイズ可能です。

• 読み取り専用アクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "elasticsearch:DescribeAckOperator",
          "elasticsearch:DescribeCollector",
          "elasticsearch:DescribeMigrationMergeConfig",
          "elasticsearch:DescribeVpcs",
          "elasticsearch:DescribeVswitches",
          "elasticsearch:GetClusterDataInformation",
          "elasticsearch:GetEmonAlarmEventList",
          "elasticsearch:GetEmonAlarmEventStatistics",
          "elasticsearch:GetEmonAlarmGroup",
          "elasticsearch:GetEmonAlarmGroupList",
          "elasticsearch:GetEmonAlarmRecordList",
          "elasticsearch:GetEmonAlarmRecordStatistics",
          "elasticsearch:GetEmonAlarmRecordStatisticsDistribute",
          "elasticsearch:GetEmonAlarmRule",
          "elasticsearch:GetEmonAlarmRuleList",
          "elasticsearch:GetEmonConsoleConfig",
          "elasticsearch:GetEmonContact",
          "elasticsearch:GetEmonContactGroup",
          "elasticsearch:GetEmonContactGroupList",
          "elasticsearch:GetEmonContactList",
          "elasticsearch:GetEmonGrafanaAlerts",
          "elasticsearch:GetEmonGrafanaDashboards",
          "elasticsearch:GetEmonProject",
          "elasticsearch:GetEmonProjectList",
          "elasticsearch:GetEmonUserConfig",
          "elasticsearch:GetMigrationJob",
          "elasticsearch:GetRegionConfiguration",
          "elasticsearch:GetSinleEmonUserConfig",
          "elasticsearch:GetWhiteListTemplates",
          "elasticsearch:ListAckClusters",
          "elasticsearch:ListAckNamespaces",
          "elasticsearch:ListApm",
          "elasticsearch:ListCollectors",
          "elasticsearch:ListDefaultCollectorConfigurations",
          "elasticsearch:ListDistinctEventInstanceIds",
          "elasticsearch:ListEcsInstances",
          "elasticsearch:ListEventRecords",
          "elasticsearch:ListInstanceHistoryEvents",
          "elasticsearch:ListMigrationJobs",
          "elasticsearch:ListNodes",
          "elasticsearch:ListStatsEventRecords",
          "elasticsearch:ListTags",
          "elasticsearch:QueryEmonMetrics",
          "elasticsearch:SuggestEmonMetric",
          "elasticsearch:SuggestEmonMetricTagKey",
          "elasticsearch:SuggestEmonMetricTagValue"
        ],
        "Resource": "*"
      }
    ]
  }
  

• フルアクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "elasticsearch:ActivePhone",
          "elasticsearch:AddWhiteListTemplate",
          "elasticsearch:AttachMigrationJob",
          "elasticsearch:CreateCollector",
          "elasticsearch:CreateComponentIndex",
          "elasticsearch:CreateEmonAlarmGroup",
          "elasticsearch:CreateEmonAlarmRule",
          "elasticsearch:CreateEmonContact",
          "elasticsearch:CreateEmonContactGroup",
          "elasticsearch:CreateEmonContactGroupContact",
          "elasticsearch:CreateEmonProject",
          "elasticsearch:CreateMigrationJob",
          "elasticsearch:DeleteCollector",
          "elasticsearch:DeleteEmonAlarmGroup",
          "elasticsearch:DeleteEmonAlarmRule",
          "elasticsearch:DeleteEmonProject",
          "elasticsearch:DeleteMigrationJobResource",
          "elasticsearch:DeleteWhiteListTemplate",
          "elasticsearch:DescribeAckOperator",
          "elasticsearch:DescribeCollector",
          "elasticsearch:DescribeMigrationMergeConfig",
          "elasticsearch:DescribeVpcs",
          "elasticsearch:DescribeVswitches",
          "elasticsearch:DisableEmonAlarmRule",
          "elasticsearch:DisableEmonContact",
          "elasticsearch:DisableEmonContactGroup",
          "elasticsearch:EnableEmonAlarmRule",
          "elasticsearch:EnableEmonContact",
          "elasticsearch:EnbaleEmonContactGroup",
          "elasticsearch:FeedbackReport",
          "elasticsearch:GetClusterDataInformation",
          "elasticsearch:GetEmonAlarmEventList",
          "elasticsearch:GetEmonAlarmEventStatistics",
          "elasticsearch:GetEmonAlarmGroup",
          "elasticsearch:GetEmonAlarmGroupList",
          "elasticsearch:GetEmonAlarmRecordList",
          "elasticsearch:GetEmonAlarmRecordStatistics",
          "elasticsearch:GetEmonAlarmRecordStatisticsDistribute",
          "elasticsearch:GetEmonAlarmRule",
          "elasticsearch:GetEmonAlarmRuleList",
          "elasticsearch:GetEmonConsoleConfig",
          "elasticsearch:GetEmonContact",
          "elasticsearch:GetEmonContactGroup",
          "elasticsearch:GetEmonContactGroupList",
          "elasticsearch:GetEmonContactList",
          "elasticsearch:GetEmonGrafanaAlerts",
          "elasticsearch:GetEmonGrafanaDashboards",
          "elasticsearch:GetEmonProject",
          "elasticsearch:GetEmonProjectList",
          "elasticsearch:GetEmonUserConfig",
          "elasticsearch:GetMigrationJob",
          "elasticsearch:GetRegionConfiguration",
          "elasticsearch:GetSinleEmonUserConfig",
          "elasticsearch:GetWhiteListTemplates",
          "elasticsearch:InitCustomModel",
          "elasticsearch:InitializeOperationRole",
          "elasticsearch:InstallAckOperator",
          "elasticsearch:ListAckClusters",
          "elasticsearch:ListAckNamespaces",
          "elasticsearch:ListApm",
          "elasticsearch:ListCollectors",
          "elasticsearch:ListDefaultCollectorConfigurations",
          "elasticsearch:ListDistinctEventInstanceIds",
          "elasticsearch:ListEcsInstances",
          "elasticsearch:ListEventRecords",
          "elasticsearch:ListInstanceHistoryEvents",
          "elasticsearch:ListMigrationJobs",
          "elasticsearch:ListNodes",
          "elasticsearch:ListStatsEventRecords",
          "elasticsearch:ListTags",
          "elasticsearch:ModifyDeployMachine",
          "elasticsearch:PostEmonAck",
          "elasticsearch:PostEmonCheckin",
          "elasticsearch:PostEmonTryAlarmRule",
          "elasticsearch:QueryEmonMetrics",
          "elasticsearch:ReinstallCollector",
          "elasticsearch:RestartCollector",
          "elasticsearch:StartCollector",
          "elasticsearch:StopCollector",
          "elasticsearch:SuggestEmonMetric",
          "elasticsearch:SuggestEmonMetricTagKey",
          "elasticsearch:SuggestEmonMetricTagValue",
          "elasticsearch:TagResources",
          "elasticsearch:UntagResources",
          "elasticsearch:UpdateCollector",
          "elasticsearch:UpdateCollectorName",
          "elasticsearch:UpdateComponentIndex",
          "elasticsearch:UpdateEmonAlarmGroup",
          "elasticsearch:UpdateEmonAlarmRule",
          "elasticsearch:UpdateEmonContact",
          "elasticsearch:UpdateEmonContactGroup",
          "elasticsearch:UpdateEmonProject",
          "elasticsearch:UpdateMigrationJob",
          "elasticsearch:UpdateWhiteListTemplate",
          "elasticsearch:ValidateSlrPermission",
          "elasticsearch:createInstance"
        ],
        "Resource": "*"
      }
    ]
  }
  

よくある質問