# Kibana Region Maps in AWS EC2 **URL:** \ **Category:** Kibana\ **Created:** [May 1, 2018, 8:22pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157 "2018-05-01T20:22:48Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![georgezoto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgezoto/32/18855_2.png) [@georgezoto](https://discuss.elastic.co/u/georgezoto)\ **Post date:** [May 1, 2018, 8:22pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157/1 "2018-05-01T20:22:48Z")
Hello Kibana team, This might be a question right on the boundary of Kibana and AWS but I am not able to find any guidance online. I am hosting Elasticsearch and Kibana 6.2.4 on a 3 node EC2 cluster for the whole purpose of utilizing region maps and forecasting (elastic cloud does not offer neither at the moment 😥 ). I am hosting all my custom region maps as geojson files in a public S3 bucket. Looking at the network traffic leaving the Kibana - EC2 instance I see requests towards the public bucket. ![Region%20Maps%20in%20EC2](https://us1.discourse-cdn.com/elastic/original/3X/5/0/507434bb59672e8d5edf96d692cf6d1fed4dbbb1.jpg) I enabled access logging in this public S3 bucket and I do not see Kibana's requests reaching it. As a result I do not see any map output on my region map visualization 🗺 Can anyone guide me and help me pinpoint the issue? Could it be S3 policy related? For this cluster I have very limited `inbound` access policies in place (`port 9200` for ES API, `port 9300` for internal ES communication and `port 9047` for Dremio) and `all traffic for outbound` (which should be the case for Kibana region map requests accessing the external S3 bucket). Do I need a specific rule on the inbound as well? What is the most secure way to accomplish this? ![EC2%20Security%20Groups](https://us1.discourse-cdn.com/elastic/original/3X/1/8/1820594f31d48e71faad87202ea006c26aca81bd.jpg) Thank you in advance, George Zoto ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [May 1, 2018, 9:19pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157/2 "2018-05-01T21:19:03Z")
Have you checked the network tab in the dev tools? Are there any logs in the browser that indicate if the requests are hanging? Hanging requests is generally a sign to me that AWS is blocking the request somehow. ---
**Author:** ![georgezoto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgezoto/32/18855_2.png) [@georgezoto](https://discuss.elastic.co/u/georgezoto)\ **Post date:** [May 1, 2018, 9:31pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157/3 "2018-05-01T21:31:08Z")
Awesome start to troubleshoot this issue @spalger! For some reason in the dev tools network tab I see a `403 Forbidden` response code. I am able to access the same URL on my browser though. 1. Is this related to the kbn-verion headers sent by Kibana? 2. Does CORS have to be in the picture here? Thank you again, George ![403%20Forbidden](https://us1.discourse-cdn.com/elastic/original/3X/0/c/0c91b3c449c8e7ceba01aa4a58888e6af1c2706c.jpg) ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [May 1, 2018, 9:33pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157/4 "2018-05-01T21:33:15Z")
Yes, I suppose it's possible that the `kbn-version` header is annoying s3 and it is responding with a 403 because it doesn't want to get that header... let me see if I can find a way to work around this without proxying requests to s3 ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [May 1, 2018, 9:40pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157/5 "2018-05-01T21:40:27Z")
Unfortunately I've confirmed that there isn't currently any way to prevent Kibana from sending this header on requests for the shape files. Perhaps you need to setup a reverse proxy that strips the kbn-version header from those request before sending them... Maybe you could serve them from your Kibana instances with a kibana plugin that proxies the requests to s3... ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [May 1, 2018, 10:57pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157/6 "2018-05-01T22:57:46Z")
Looks like you might be able to configure your s3 bucket to accept the kbn-version header: [https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html) ---
**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\ **Post date:** [May 2, 2018, 4:10pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157/7 "2018-05-02T16:10:11Z")
@georgezoto, can you modify the CORS settings for your S3 bucket to explicitly allow the `kbn-version` header? [https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html](https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html) We've had issues in the past that some browsers/server-combos do not handle the `*` wildcard correctly. This was not for S3 in particular, but may be an issue here. ---
**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\ **Post date:** [May 3, 2018, 7:29pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157/8 "2018-05-03T19:29:01Z")
I can confirm that the default CORS settings for public S3 buckets will not work with the `kbn-version` header. You specifically have to allow this in the CORS setting for the bucket. For example, here are the CORS settings that worked for my test S3 bucket. ```auto * GET 3000 kbn-version ``` ---
**Author:** ![georgezoto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgezoto/32/18855_2.png) [@georgezoto](https://discuss.elastic.co/u/georgezoto)\ **Post date:** [May 3, 2018, 9:18pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157/9 "2018-05-03T21:18:26Z")
Finally, this is working 🗺 . Thank you @spalger, @thomasneirynck and @nickpeihl, S3 CORS configuration was successful. For completeness here is an extra link I used: [https://docs.aws.amazon.com/AmazonS3/latest/user-guide/add-cors-configuration.html](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/add-cors-configuration.html) Thank you, George ![AWS%20S3%20CORS](https://us1.discourse-cdn.com/elastic/original/3X/8/3/836217b4b6d5994fbbd6ff4dc6705d029b506ff1.jpg) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 31, 2018, 9:18pm UTC](https://discuss.elastic.co/t/kibana-region-maps-in-aws-ec2/130157/10 "2018-05-31T21:18:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.