(elasticsearch): Amazon ES permissions to associate your certificate

[Cloudrage]

When trying to create a Domain with my own Certificate, I have an error :

Before you can proceed, you must enable a service-linked role to give Amazon ES permissions to associate your certificate

Reproduction Steps

When using customEndpoint props in Domain construct :
https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticsearch.Domain.html

Environment

• CDK CLI Version : 1.91.0

---

This is 🐛 Bug Report

[Cloudrage]

Same issue when created by default.

[iliapolo]

@Cloudrage

Same issue when created by default.

You mean when a certificate is created for you when using custom domains? Could you paste here the exact configuration you are using?

Also, wondering if you can answer these two questions for me:

• Does your account have the AWSServiceRoleForAmazonElasticsearchService role?
• Does your account have the AmazonElasticsearchServiceRolePolicy policy?

[Cloudrage]

Hi @iliapolo ,

Yes I've these 2 IAM resources.
But now it's working as expected...

And in both case, a certificate create for me or with my own one.

I've made the Custom Endpoint through the console, manually I've I've encountered the same pb.
But it seems that these IAM resources was created on my behalf at this moment.

So now, with CDK, it's working properly...

These ServiceRoles aren't available by default ?
There is a way to do that "one shot" the first time we create the Stack/ELK ?

[iliapolo]

@Cloudrage

I've made the Custom Endpoint through the console, manually I've I've encountered the same pb.
But it seems that these IAM resources was created on my behalf at this moment.

Yes. The docs state that:

You don't need to manually create a service-linked role. When you create a VPC access domain using the AWS Management Console, Amazon ES creates the service-linked role for you

So I imagine the console is also creating the SLR in other scenarios, when needed. Unfortunately this isn't the behavior of the CloudFormation resource.

There is no natural way to do these "one shot" operations. But you can create the SLR via CDK:

const slr = new iam.CfnServiceLinkedRole(this, 'ElasticSLR', {
  awsServiceName: 'es.amazonaws.com'
});

const domain = es.Domain(...);

domain.node.addDependency(slr);

So if you put the SLR in its own dedicated stack, that all other stacks containing an ES cluster will depend on, that should do the trick. But note that if any other CDK application also tries to do this, the deployment will fail.

[iliapolo]

I will add some explanation around this in the package README - definitely tricky to figure out.

[Cloudrage]

Thanks for that @iliapolo !

Yes that's the deal, since few years I've made some workarounds (CustomResources, scripts or Hooks) about some SLR, especially for ASG because like you said in our case, if it's created by CDK through another Stack/App, it'll fail.

Don't know why AWS don't provide them by default, like provided "jobs" for example...