(elasticsearch): Elasticsearch must be authorised to describeSubnets

Received response status [FAILED] from custom resource. Message returned: Unauthorized Operation: Elasticsearch must be authorised to describeSubnets (RequestId: f49d7ea9-6d61-4951-98fc-eeda71bb2451)

Reproduction Steps

const { Domain, ElasticsearchVersion, TLSSecurityPolicy } = require('@aws-cdk/aws-elasticsearch');
const { Role, PolicyStatement, Effect, AnyPrincipal, ArnPrincipal } = require('@aws-cdk/aws-iam');

const esDomain = new Domain(this, 'MyElasticsearchDomain', {
      version: ElasticsearchVersion.V7_10,
      domainName: domainName,
      vpc: vpc, 
      ebs: {
          enabled: true,
          volumeSize: elasticsearchEbsVolume,
      },
      capacity: {
          dataNodeInstanceType: instanceType,
          dataNodes: 2,
      },
      cognitoKibanaAuth: {
          enabled: true,
          identityPoolId: cognitoIdentityPoolId,
          role: Role.fromRoleArn(this, 'CognitoRoleArn', cognitoRoleArn),
          userPoolId: cognitoUserPoolId,
      },
      enforceHttps: true,
      tlsSecurityPolicy: TLSSecurityPolicy.TLS_1_2,
      advancedOptions: {
          'rest.action.multi.allow_explicit_index': 'true',
          'override_main_response_version': 'true',
      },
      accessPolicies: [
          new PolicyStatement({
              effect: Effect.ALLOW,
              actions: ['es:*'],
              principals: [
                  new AnyPrincipal(), // remove this in prod
                  new ArnPrincipal(`arn:aws:sts::${env.account}:assumed-role/${cognitoIdentityPoolAuthRole}/CognitoIdentityCredentials`),
              ],
              resources: [`arn:aws:es:${env.region}:${env.account}:domain/${domainName}/*`],
          })
      ],
      zoneAwareness: {
          enabled: true,
          availabilityZoneCount: 2, // default is 2
      }
});

What did you expect to happen?

Elasticsearch domain to be created.

What actually happened?

Elasticsearch domain was created but there’s no access policy.

Environment

• CDK CLI Version : 1.122.0
• Framework Version: 1.122.0
• Node.js Version: v14.17.6
• OS : Ubuntu 20.04
• Language (Version): JavaScript

Other

Similar issue in stackoverflow

---

This is 🐛 Bug Report

[miklinson]

@prashanttct07 confirmed. I’ve successfully created an Elasticsearch domain without any issues. Can you please share a link / reference saying the issue was with the Service Linked Role (SLR) and the confirmation that it has been fixed and deployed. Thanks!

[prashanttct07]

There was an issue with Service Linked Role (SLR), which has been fixed and deployed. Please check now and you should not be getting any such error while creating the domain.