diff --git a/provider/indexer-aws/CloudFormation/Automated/elasticsearch.yml b/provider/indexer-aws/CloudFormation/Automated/elasticsearch.yml
index 9baa1cef193a611340c3126d1aae7ed22e46070f..b309e03a0c1b8e6b114866630b9529377692c26b 100644
--- a/provider/indexer-aws/CloudFormation/Automated/elasticsearch.yml
+++ b/provider/indexer-aws/CloudFormation/Automated/elasticsearch.yml
@@ -194,7 +194,11 @@ Resources:
                     !Sub "${Environment}-IndexerServiceIamUserArn"
                   # TODO: need to create cognito user and identity pool and link it to principal for dynamic creation
                 - "arn:aws:iam::888733619319:role/Cognito_osduelasticsearchAuth_Role"
-            Action: "es:*"
+            Action:
+              - "es:*"
+              - 'cognito-identity:*'
+              - 'cognito-idp:*'
+              - 'sts:AssumeRole'
             Resource: !Sub arn:aws:es:us-east-1:846973539254:domain/${Environment}-${ElasticsearchDomainName}/*
       AdvancedOptions:
         rest.action.multi.allow_explicit_index: "true"
diff --git a/provider/indexer-aws/CloudFormation/Automated/iam-credentials.yml b/provider/indexer-aws/CloudFormation/Automated/iam-credentials.yml
index fbfc9aa484869f31ea993d759ba0ee0da56a4fa9..a05ba524f73eed6cd5f4a3e720796c0c406d0787 100644
--- a/provider/indexer-aws/CloudFormation/Automated/iam-credentials.yml
+++ b/provider/indexer-aws/CloudFormation/Automated/iam-credentials.yml
@@ -70,8 +70,6 @@ Resources:
                   - 'sts:AssumeRole'
                 Effect: Allow
                 Resource: '*'
-                Principal:
-                    Service: es.amazonaws.com
       UserName: !Sub ${Environment}-${IndexerServiceIamUsername}
 
   IndexerServiceIamUserAccessKey: