I've started setting up an [[https://aws.amazon.com/blogs/aws/new-amazon-elasticsearch-service/ | Amazon Elasticsearch]] cluster for our Phabricator install. One issue that I had is that I can't currently use instance profiles to restrict access, see http://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-gsg-upload-data.html:
> Standard clients, such as curl, cannot perform the request signing that is required of identity-based access policies. You must use an IP address-based access policy that allows anonymous access to successfully perform the instructions for this step.
In order to do this, I would need to be able to inject IAM temporary credentials into the requests, similar to T5155.