title: Let AWS EC2 access ElasticSearch behind Cognito Auth
body: <p>I have an AWS ElasticSearch cluster inside a VPC with a Kibana plugin. I'm trying to achieve 2 things:</p>
  
  <ol>
  <li>Have Kibana accessible to the world, behind cognito authentication</li>
  <li>Let my EC2 inside the same VPC write and read from this ElasticSearch cluster</li>
  </ol>
  
  <p>I'm having problems with the second part.</p>
  
  <p>I configured Cognito authentication to this cluster: </p>
  
  <p>I made a User Pull with a domain name, and an Identity Pool, and I activated Kibana authentication with them. </p>
  
  <p>Also, I changed the access policy to only allow access from the Cognito role:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": [
            "arn:aws:iam::000000000000:role/Cognito_KibanaUsersAuth_Role"
          ]
        },
        "Action": "es:*",
        "Resource": "arn:aws:es:us-west-2:000000000000:domain/my-domain/*"
      }
    ]
  }
  </code></pre>
  
  <p>(<a href="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-cognito-auth.html#es-cognito-auth-config-ac" rel="nofollow noreferrer">Like in this guide's step</a>)</p>
  
  <p>Before I did all this, I had EC2 instances in the VPC working freely with the ElasticSearch.
  I read that after I activate ES Cognito authentication, I need to sign my requests to ElasticSearch, and I did:</p>
  
  <pre><code>region = 'us-west-2'
  service = 'es'
  credentials = boto3.Session().get_credentials()
  awsauth = AWS4Auth(credentials.access_key, credentials.secret_key, region, service)
  requests.get(es_url, auth=awsauth)
  </code></pre>
  
  <p>(<a href="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-request-signing.html#es-request-signing-python" rel="nofollow noreferrer">Like in this guide</a>)</p>
  
  <p>I'm getting this error: <code>User: anonymous is not authorized to perform: es:ESHttpGet</code>.</p>
  
  <p>I want my EC2 to be authenticated in Cognito, so I can work with ES from there. How do I achieve this?</p>