title: AWS Firehose delivery to Cross Account Elasticsearch in VPC
body: <p>I have a Elasticsearch inside the VPC running in account A.</p>
  
  <p>I want to deliver logs from Firehose in Account B to the Elasticsearch in Account A.</p>
  
  <p>Is it possible?</p>
  
  <p>When I try to create delivery stream from AWS CLI I am getting below exception,</p>
  
  <pre><code>$: /usr/local/bin/aws firehose create-delivery-stream --cli-input-json file://input.json --profile devops
  An error occurred (InvalidArgumentException) when calling the CreateDeliveryStream operation: Verify that the IAM role has access to the ElasticSearch domain.
  </code></pre>
  
  <p>The same IAM role, and same input.json works when modified to the Elasticsearch in Account B. I have Transit gateway connectivity enabled between the AWS accounts and I can connect telnet to the Elasticsearch in Account A from EC2 instance in Account B.</p>
  
  <p>Adding my complete terraform code(i got same exception in AWS CLI and also in Terraform):
  <a href="https://gist.github.com/karthikeayan/a67e93b4937a7958716dfecaa6ff7767" rel="nofollow noreferrer">https://gist.github.com/karthikeayan/a67e93b4937a7958716dfecaa6ff7767</a></p>