Getting no permission messages when trying to restore or delete indices in Opensearch/Elasticsearch

Question

Hi,

I followed this link https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html in registering a snapshot repository as well as creating a snapshot and restoring a snapshot.

Unfortunately, I hit a snag as I am getting errors when I was about to restore a snapshot from the S3 repository that I created and the error looks like this after executing the sample python script from the link that I am following.

`{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=arn:aws:iam::xxxxxx:user/xxxxx, backend_roles=[], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=arn:aws:iam::xxxxxx:user/xxxxx, backend_roles=[], requestedTenant=null]"},"status":403}`

I already mapped the users and the IAM role in the backend role in Kibana but it doesn't make pretty much any change. Hope someone could help.

Thanks,

Accepted Answer

Hello,

Your understanding is correct. We receive following error while restoring snapshot even after having all the required permissions and mapping in backend roles when we try to restore internal index such as `.kibana`,`.opendistro_security`, etc.

Error:
```
{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=arn:aws:iam::xxxxxx:user/xxxxx, backend_roles=[], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=arn:aws:iam::xxxxxx:user/xxxxx, backend_roles=[], requestedTenant=null]"},"status":403}
```

In order to mitigate this issue, Please exclude the internal dashboard and fine-grained access control indices while restoring the data from snapshots.

```
curl -XPOST 'domain-endpoint/_snapshot/cs-automated/2020-snapshot/_restore' \
-d '{"indices": "-.kibana*,-.opendistro*"}' \
-H 'Content-Type: application/json'
```

[+] Creating index snapshots in Amazon OpenSearch Service - Restoring snapshots - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html#managedomains-snapshot-restore

Regarding your query to migrate users and permissions to another domain, I would like to inform you that currently we don’t have any workaround for this use case. You will have to create your users and permissions again in new OpenSearch domain.

Getting no permission messages when trying to restore or delete indices in Opensearch/Elasticsearch

관련 콘텐츠