title: 403 Error when indexing data from AWS Lambda to Elasticsearch using Sig v4: 'no permissions for [indices:data/write/bulk] '
body: <p>My function can index documents in single and bulk to my AWS Elasticsearch from a local Jupyter notebook, but when I deploy to Lambda it keeps returning this error:</p>
  <pre><code>&quot;errorMessage&quot;: &quot;AuthorizationException(403, 'security_exception', 'no permissions for
  [indices:data/write/bulk] and User [name=arn:aws:iam::xxxxxxxxxxxx:role/MyLambdaRole,
  backend_roles=[arn:aws:iam::xxxxxxxxxxxx:role/MyLambdaRole], requestedTenant=null]')&quot;
  </code></pre>
  <p>My Elasticsearch domain (v7.7) is configured as such:</p>
  <pre><code>Fine-grained access control: Enabled
  Master user type: Internal user database
  SAML authentication: Disabled
  Amazon Cognito for authentication: Disabled
  Require HTTPS: Enabled
  Encryption at rest: Enabled
  KMS master keyarn:aws:kms:us-east-1:xxxxxxxxxxxxx:key/&lt;aws/es key&gt;
  Node-to-node encryption: Enabled
  </code></pre>
  <p>The domain's access policy contains:</p>
  <pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;AWS&quot;: &quot;*&quot;
        },
        &quot;Action&quot;: &quot;es:*&quot;,
        &quot;Resource&quot;: &quot;*&quot;
      }
    ]
  }
  </code></pre>
  <p>The IAM policy for MyLambdaRole contains:</p>
  <pre><code>...
          {
              &quot;Action&quot;: [
                  &quot;es:*&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;*&quot;
              ],
              &quot;Effect&quot;: &quot;Allow&quot;
          }
      ]
  </code></pre>
  <p>In Kibana I have mapped both my AWS admin IAM user and MyLambdaRole under Security -&gt; Role Mappings -&gt; all_access. I have tried different combinations of adding them to Backend roles and also adding them to security_manager.</p>
  <p>The Lambda uses AWS Signature v4 authentication and the elasticsearch client is version 7.7.0:</p>
  <pre class="lang-py prettyprint-override"><code>import boto3
  from elasticsearch import Elasticsearch, RequestsHttpConnection, helpers
  from requests_aws4auth import AWS4Auth
  
  session = boto3.Session()
  credentials = session.get_credentials().get_frozen_credentials()
  
  awsauth = AWS4Auth(credentials.access_key, credentials.secret_key, \
      session.region_name, 'es', session_token=credentials.token)
  
  host = 'search-es-domain.us-east-1.es.amazonaws.com'
  
  es = Elasticsearch(
      hosts = [{'host': host, 'port': 443}],
      http_auth = awsauth
      use_ssl = True,
      verify_certs = True,
      connection_class = RequestsHttpConnection
  )
  
  # Single indexing call
  document = { my data }
  es.index(index=&quot;my_index&quot;, doc_type=&quot;_doc&quot;, id=doc_id, body=document)
  
  # Bulk indexing call
  k = ({ my data })
  helpers.bulk(es, k)
  </code></pre>
  <p>If I replace <code>http_auth = awsauth</code> with my Kibana credentials <code>http_auth = (kibana_username, kibana_password)</code> it returns status 200 but then no new documents are created in the index which is weird.</p>
  <p>I would like to know what I could be missing or where my configuration could be off.</p>