How to modify do_not_fail_on_forbidden setting in Opensearch Cluster ?

I apologize, but I don't have specific information about modifying the "do_not_fail_on_forbidden" setting in Amazon OpenSearch Service clusters. This particular setting is not mentioned in the provided sources about OpenSearch configuration and access control.

However, to restrict index access for specific users in Amazon OpenSearch Service, you have several options:

1. Use fine-grained access control: You can create custom roles with specific index-level permissions and map these roles to users. This allows you to control which indexes each user can access.

2. Implement resource-based policies: You can create domain access policies that specify which actions a principal (user) can perform on the domain's subresources, including specific indexes.

3. Utilize field-level security: This feature allows you to control access to specific fields within documents for different users.

If you need to modify specific OpenSearch settings, Amazon OpenSearch Service does have some limitations compared to self-managed OpenSearch clusters. Only certain settings can be changed using the _cluster/settings API.

For the most accurate and up-to-date information on modifying specific settings or restricting index access in your Amazon OpenSearch Service cluster, I recommend consulting the official AWS documentation or contacting AWS support directly.
Sources
Identity and Access Management in Amazon OpenSearch Service - Amazon OpenSearch Service
Field-level security in Amazon OpenSearch Service | AWS Big Data Blog

I would look into Fine Grain Access Controls for OpenSearch. In the docs we can see that it provides Security at the index, document, and field level. In this case we want to implement it at the Index level. It is also recommended to use domain access policy that does not require signed requests. You can read more about this recommendation in the docs link provided above specifically under the note:

If a resource-based access policy contains IAM roles or users, clients must send signed requests using AWS Signature Version 4. As such, access policies can conflict with fine-grained access control, especially if you use the internal user database and HTTP basic authentication. You can't sign a request with a username and password and IAM credentials. In general, if you enable fine-grained access control, we recommend using a domain access policy that doesn't require signed requests.

First you'll want to ensure it is enabled by goign to your OpenSearch, then go to Security, and ensure it is enabled in there. To enable it on an existing domain rather than creating a new one ensure you have OpenSearch or Elasticsearch 6.7 or above. If you cannot use any of those newer versions, you can always create a new domain to do so.

Inside the linked doc you will find examples of how to implement this solution.