A company has multiple AWS Site-to-Site VPN connections between a VPC and its branch offices.

To ensure that Amazon Elasticsearch Service (Amazon ES) can be accessed only from the branch offices while preserving existing data, an IP-based domain access policy is the best approach. This allows you to restrict access to specific IP ranges.

Configure an IP-Based Domain Access Policy:

Navigate to the Amazon ES console.

Select the domain and go to the "Access policies" tab.

Update the Access Policy:

Edit the access policy to include an allow statement for the private IP CIDR blocks of each branch office.

Example policy:

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Principal": "*",

"Action": "es:*",

"Condition": {

"IpAddress": {

"aws:SourceIp": [

"branch-office-cidr-1",

"branch-office-cidr-2"

]

}

}

}

]

}

Verify the Configuration:

Ensure that the policy correctly restricts access to the specified IP ranges.

Test access from the branch offices to confirm connectivity.

Amazon Elasticsearch Service Access Control

Configuring Access Policies