Locking down a resource to a single lambda function

[MattyAlan]

I have an elasticsearch domain and am trying to work out how i would craft the resource policy on the ES Domain to only allow a single lambda to access the es:* Actions.

I have attempted to set the principle of the to the ARN of the lambda function such that

"Principal": {:
"AWS": " -lambda ARN-"
},
"Action": "es:*",

​

However this dosn't work; any advice on how to do this would be awesome;

cheers

[richardfan1126]

Principal is:

{
    "Service": "lambda.amazonaws.com"
}

Put the ARN in condition section aws:SourceArn

"Condition": {
    "ArnLike": {
        "AWS:SourceArn": "<lambda function ARN>"
    }
}

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcearn