OpenSearch error: no permissions for [cluster:admin/repository/put] and User [name=arn:aws-us-gov:iam::123456789012:user/opensearch-repo-user

Question

Hi

I want to create index snapshots in Amazon OpenSearch. I followed the instructions shown in https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html.

I mapped the snapshot role as shown in https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshot-registerdirectory.html#managedomains-snapshot-fgac.

Fine-grained access control is enabled, and Master user type is "Internal user database".

I signed in to the AWS account using IAM user which has administrative access.

I sent the following request through Postman.

```
PUT "https://vpc-nios-gov-opensearch-eu3jvkddhehkedtszozcwaacym.us-gov-east-1.es.amazonaws.com/_snapshot/nios-snapshot-repo" \
    -H 'Content-Type: application/json' \
    -d '{
          "type": "s3",
          "settings": {
            "bucket": "nios-opensearch-snapshot",
            "region": "us-gov-east-1",
            "role_arn": "arn:aws-us-gov:iam::123456789012:role/AmazonOpenSearchSnapshotRole"
          }
        }'
```
	
And I got the following error:

```
{
    "error": {
        "root_cause": [
            {
                "type": "security_exception",
                "reason": "no permissions for [cluster:admin/repository/put] and User [name=arn:aws-us-gov:iam::123456789012:user/opensearch-repo-user, backend_roles=[], requestedTenant=null]"
            }
        ],
        "type": "security_exception",
        "reason": "no permissions for [cluster:admin/repository/put] and User [name=arn:aws-us-gov:iam::123456789012:user/opensearch-repo-use, backend_roles=[], requestedTenant=null]"
    },
    "status": 403
}
```

What could go wrong?

Thanks.

Sonic · Accepted Answer

For guidance on IAM user and role creation, please refer to this video: https://www.youtube.com/watch?v=KeUBwm-aalU. Then I used Postman for the API calls to resolve the issue.

re:Post Agent · Answer

This error indicates a permissions issue where your user doesn't have the necessary permissions to create a snapshot repository in OpenSearch. The error specifically shows that the user "arn:aws-us-gov:iam::123456789012:user/opensearch-repo-user" lacks the "cluster:admin/repository/put" permission required for this operation.

Since you have fine-grained access control enabled with an internal user database, you need to ensure that the user making the request has the appropriate role mappings. Here are some steps to resolve this issue:

1. Log in to OpenSearch Dashboards as an admin user.

2. Check your existing role mappings by running:
```
GET _plugins/_security/api/rolesmapping
```

3. Verify that your user (opensearch-repo-user) is properly mapped to a role that has snapshot permissions. The role mappings are case-sensitive, so ensure they exactly match the values in your configuration.

4. If the mappings don't exist or are incorrect, you need to create or update the role mappings to grant your user the necessary permissions for snapshot operations.

5. Make sure the role you're mapping to has the "cluster:admin/repository/put" permission, which is required for creating snapshot repositories.

Remember that even though you signed in with an IAM user that has administrative access, OpenSearch's fine-grained access control operates independently of IAM permissions. You need to explicitly grant the necessary permissions within OpenSearch's security model.

If you've already mapped the snapshot role as you mentioned, double-check that the mapping is correct and that the role has the specific permission needed for this operation.  
**Sources**  
[Create and schedule manual snapshots in OpenSearch Service | AWS re:Post](https://repost.aws/knowledge-center/opensearch-create-schedule-manual-snapshots)  
[Configure SAML 2.0 authentication in OpenSearch Service | AWS re:Post](https://repost.aws/knowledge-center/opensearch-configure-saml)

OpenSearch error: no permissions for [cluster:admin/repository/put] and User [name=arn:aws-us-gov:iam::123456789012:user/opensearch-repo-user

Add your answer

Relevant content