updating

provider/indexer-aws/CloudFormation/Automated/elasticsearch.yml

@@ -184,22 +184,29 @@ Resources:
       SnapshotOptions:
         AutomatedSnapshotStartHour: "0"
       AccessPolicies:
-        Version: "2012-10-17"
-        Statement:
-          - Effect: "Allow"
-            Principal:
-              AWS:
-                - !Sub arn:aws:iam::${AWS::AccountId}:root
-                - Fn::ImportValue:
-                    !Sub "${Environment}-IndexerServiceIamUserArn"
-                  # TODO: need to create cognito user and identity pool and link it to principal for dynamic creation
-                - "arn:aws:iam::888733619319:role/Cognito_osduelasticsearchAuth_Role"
-            Action:
-              - "es:*"
-              - 'cognito-identity:*'
-              - 'cognito-idp:*'
-              - 'sts:AssumeRole'
-            Resource: !Sub arn:aws:es:us-east-1:846973539254:domain/${Environment}-${ElasticsearchDomainName}/*
+        - Version: "2012-10-17"
+            Statement:
+              - Effect: "Allow"
+                Principal:
+                  AWS:
+                    - !Sub arn:aws:iam::${AWS::AccountId}:root
+                    - Fn::ImportValue:
+                        !Sub "${Environment}-IndexerServiceIamUserArn"
+                      # TODO: need to create cognito user and identity pool and link it to principal for dynamic creation
+                    - "arn:aws:iam::888733619319:role/Cognito_osduelasticsearchAuth_Role"
+                Action:
+                  - "es:*"
+                  - 'es:ESHttp*'
+                  - 'cognito-identity:*'
+                  - 'cognito-idp:*'
+                  - 'sts:AssumeRole'
+                Resource: !Sub arn:aws:es:us-east-1:846973539254:domain/${Environment}-${ElasticsearchDomainName}/*
+        - "Version": "2012-10-17"
+          "Statement":
+            - "Effect": "Allow"
+              "Action":
+                - "iam:PassRole"
+              "Resource": "arn:aws:iam::888733619319:role/service-role/CognitoAccessForAmazonES"
       AdvancedOptions:
         rest.action.multi.allow_explicit_index: "true"
       Tags: