title: Signing ElasticSearch AWS calls
body: <p>I'm attempting to sign all of our AWS calls to ElasticSearch however the response is always;</p>
  
  <p><code>User: anonymous is not authorized to perform: es:ESHttpGet on resource:</code></p>
  
  <p>I've tried multiple key pairs and IAM users.</p>
  
  <p>The calls within our PHP are made using the official <a href="https://github.com/elastic/elasticsearch-php" rel="noreferrer">elasticsearch-php client</a> and all requests are signed using the connector found <a href="https://github.com/wizacha/AwsSignatureMiddleware" rel="noreferrer">here</a>.</p>
  
  <p>Shown below is how we build the ElasticSearch client and apply signing middleware;</p>
  
  <pre><code>$credentials = new Credentials('&lt;KEY&gt;', '&lt;SECRET&gt;');
  $signature = new SignatureV4('es', 'eu-central-1');
  
  $middleware = new AwsSignatureMiddleware($credentials, $signature);
  $defaultHandler = ESClientBuilder::defaultHandler();
  $awsHandler = $middleware($defaultHandler);
  
  $clientBuilder =  ESClientBuilder::create();
  
  $clientBuilder
      -&gt;setHandler($awsHandler)
      -&gt;setHosts(['&lt;URL&gt;']);
  $this-&gt;_client = $clientBuilder-&gt;build();
  </code></pre>
  
  <p>For reference the policy attached to the elasticsearch instance we are trying to access is;</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::&lt;IAM_USER&gt;"
        },
        "Action": "es:*",
        "Resource": "&lt;RESOURCE&gt;/*"
      }
    ]
  }
  </code></pre>
  
  <p>Other info;</p>
  
  <ul>
  <li>We are using the Laravel framework, version 5.4.7</li>
  <li>Elasticsearch client version 5.3.2</li>
  </ul>