There is a bug in the implementation of the Auth class

[nsano-rururu]

Currently, if there is a value in the argument aws_region or the environment variable AWS_DEFAULT_REGION, it will proceed to the aws process, but if the process is executed without the profile_name value, an error will occur. I think we need to add a check for the value of profile_name as well.
https://github.com/jertel/elastalert2/blob/master/elastalert/auth.py#L53

current

        if not aws_region and not os.environ.get('AWS_DEFAULT_REGION'):
            return None

        session = boto3.session.Session(profile_name=profile_name, region_name=aws_region)

        return RefeshableAWSRequestsAuth(
            refreshable_credential=session.get_credentials(),
            aws_host=host,
            aws_region=session.region_name,
            aws_service='es')

fix idea

        if not aws_region and not os.environ.get('AWS_DEFAULT_REGION'):
            return None

        if not profile_name:
            return None

        session = boto3.session.Session(profile_name=profile_name, region_name=aws_region)

        return RefeshableAWSRequestsAuth(
            refreshable_credential=session.get_credentials(),
            aws_host=host,
            aws_region=session.region_name,
            aws_service='es')

[jertel]

According to the documentation the signing auth process attempts the following:

1. If user/pass provided, use standard http auth.
2. If region is provided but not profile, assume using an "Instance" profile (which does not require the profile_name param.
3. If region and profile are both provided assume using an AWS profile (via the client's .aws/ directory)

If that documentation is accurate then your proposed change would potentially block #2 from working. I've not tried this, and I don't use this configuration, so I am unable to validate this.

[nsano-rururu]

As a result of investigating the document description, if the description is different from the implementation, it may be corrected.
https://elastalert2.readthedocs.io/en/latest/recipes/signing_requests.html

[nsano-rururu]

Organize

The following statement in the document is a lie. Not implemented. It is assumed that you will use a profile.

https://elastalert2.readthedocs.io/en/latest/recipes/signing_requests.html

Using an Instance Profile
Typically, you’ll deploy ElastAlert 2 on a running EC2 instance on AWS. You can assign a role to this instance that gives it permissions to read from and write to the Elasticsearch service. When using an Instance Profile, you will need to specify the aws_region in the configuration file or set the AWS_DEFAULT_REGION environment variable.

If the following code is executed when the profile name is not specified with the value of aws_region, the exception botocore.exceptions.ProfileNotFound: The config profile (a) could not be found is thrown.

session = boto3.session.Session(profile_name=profile_name, region_name=aws_region)

The following checks are missing in the current implementation

        if not profile_name and not os.environ.get('AWS_DEFAULT_PROFILE'):
            return None

---

To see if the following can be achieved, it is necessary to create an environment for Amazon Elasticsearch Service and check the operation.

https://elastalert2.readthedocs.io/en/latest/recipes/signing_requests.html

Using an Instance Profile
Typically, you’ll deploy ElastAlert 2 on a running EC2 instance on AWS. You can assign a role to this instance that gives it permissions to read from and write to the Elasticsearch service. When using an Instance Profile, you will need to specify the aws_region in the configuration file or set the AWS_DEFAULT_REGION environment variable.

[jertel]

Ok. If you are confident it's not implemented feel free to push the fix and doc change. Thanks for your research on this.

[nsano-rururu]

There are no plans to make a pull request in a hurry at this time. Because there are no inquiries from users.

[nsano-rururu]

The name of Amazon Elasticsearch Service was changed to Amazon OpenSearch Service