Suggested IAM Policy for Lambda functions is too broad.

[maitreya1975]

The docs suggest a policy for ElasticSearch for the Lambda function that is too broad: i.e. it allows all actions on ElasticSearch, including deleting the domain:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "es:*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

I suggest scoping this down to just the POST action on a specific index in the domain:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "es:ESHttpPost"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:es:region:aws-account-id:domain/domain-name/test-index"
        }
    ]
}