Getting no permission messages when trying to restore or delete indices in Opensearch/Elasticsearch

0

Hi,

I followed this link https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html in registering a snapshot repository as well as creating a snapshot and restoring a snapshot.

Unfortunately, I hit a snag as I am getting errors when I was about to restore a snapshot from the S3 repository that I created and the error looks like this after executing the sample python script from the link that I am following.

{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=arn:aws:iam::xxxxxx:user/xxxxx, backend_roles=[], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=arn:aws:iam::xxxxxx:user/xxxxx, backend_roles=[], requestedTenant=null]"},"status":403}

I already mapped the users and the IAM role in the backend role in Kibana but it doesn't make pretty much any change. Hope someone could help.

Thanks,

  • UPDATE: It is suspected that the error was caused by an .opendistro_security index refusing to be overwritten by the restoration process. It would be better if someone here can recommend a way how to backup Elasticsearch users and their permissions and restore to another Elasticsearch domain.

1 Answer
1
Accepted Answer

Hello,

Your understanding is correct. We receive following error while restoring snapshot even after having all the required permissions and mapping in backend roles when we try to restore internal index such as .kibana,.opendistro_security, etc.

Error:

{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=arn:aws:iam::xxxxxx:user/xxxxx, backend_roles=[], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=arn:aws:iam::xxxxxx:user/xxxxx, backend_roles=[], requestedTenant=null]"},"status":403}

In order to mitigate this issue, Please exclude the internal dashboard and fine-grained access control indices while restoring the data from snapshots.

curl -XPOST 'domain-endpoint/_snapshot/cs-automated/2020-snapshot/_restore' \
-d '{"indices": "-.kibana*,-.opendistro*"}' \
-H 'Content-Type: application/json'

[+] Creating index snapshots in Amazon OpenSearch Service - Restoring snapshots - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html#managedomains-snapshot-restore

Regarding your query to migrate users and permissions to another domain, I would like to inform you that currently we don’t have any workaround for this use case. You will have to create your users and permissions again in new OpenSearch domain.

AWS
SUPPORT ENGINEER
Rajat_C
answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions