[aws-elasticsearch] ElasticSearch Domain Name Change Unsupported

[taylor-zr]

Changing DomainName for ES domains created with aws-elasticsearch is not supported. For example, I changed:

var elasticsearchDomain = new elasticsearch.CfnDomain(this, 'ElasticsearchDomain', {
            domainName: ccpName + suffix,
            ...
}

To

var elasticsearchDomain = new elasticsearch.CfnDomain(this, 'ElasticsearchDomain', {
            domainName: ccpName + suffix.substring(0, 8),
            ...
}

And I received:

2020-07-07 13:58:55 UTC+1000 | ElasticsearchDomain | UPDATE_FAILED | User: arn:aws:iam::228438115886:user/Workaround is not authorized to perform: es:DescribeElasticsearchDomain on resource: arn:aws:es:us-east-1:228438115886:domain/taylorzr${Token[ (Service: AWSElasticsearch; Status Code: 403; Error Code: AccessDeniedException; Request ID: a7c5be5e-3a78-4c60-b382-ceda9e5a5348)
-- | -- | -- | --
2020-07-07 13:58:54 UTC+1000 | ElasticsearchDomain | UPDATE_IN_PROGRESS | Requested update requires the creation of a new physical resource; hence creating one.

Environment

• CLI Version : 1.46.0
• Framework Version: 1.49.1
• Node.js Version: 12.14.1
• OS : Mac 10.14.6
• Language (Version): Typescript

[iliapolo]

Hi @taylor-zr

The CfnDomain class is auto-generated from the CloudFormation specification. It does not contain any special permissions logic. As such, this isn't strictly a bug in CDK, but rather a matter of having the necessary permissions for the user running the deployment.

Are you running it with an assumed role? Perhaps the Workaround user you use is not an admin and has limited permissions?

You just need to add the es:DescribeElasticsearchDomain statement to the role of your user.

Having said that, I will mark that we should add this to the documentation. Thanks!

Hope this helps.

[taylor-zr]

Root cause was substring on a string encoded token rather than an actual string -- resolving