We ran into the access control limitations as well. They are caused by the fact that for some reason AWS ES only supports resource based policies which is imho the wrong way around to manage your policies.
We did get it to work in a useable manner by having the ES policy apply to a role (i.e. the principal is a role).
If you than apply that role to your instances it will work for with instance profile based auth.
We did get it to work in a useable manner by having the ES policy apply to a role (i.e. the principal is a role). If you than apply that role to your instances it will work for with instance profile based auth.