Can i use identity center user or permission sets as master user in amazon opensearch?

Unfortunately, you cannot directly use AWS IAM Identity Center (formerly AWS Single Sign-On) users or permission sets as the master user for Amazon OpenSearch Service. The error message you're seeing is correct - OpenSearch currently only supports IAM users or roles as master users for fine-grained access control.

When configuring a master user for your OpenSearch domain, you have two main options:

1. Use an existing IAM user or role: This is the option you're seeing in the error message. You would need to create a dedicated IAM user or role for this purpose.

2. Create a master user within OpenSearch's internal user database: This option allows you to create a username and password combination specifically for OpenSearch.

Even though you're using AWS Control Tower and Identity Center for most of your access management, for OpenSearch, you'll need to create a separate IAM user or role to serve as the master user. This IAM principal will be used purely for authentication purposes in OpenSearch, and its IAM permissions don't affect its authorization within OpenSearch.

However, it's worth noting that while you can't use Identity Center directly for the master user, you can still integrate Identity Center with OpenSearch for other users:

1. For OpenSearch Service domains, you can enable IAM Identity Center authentication for API access and OpenSearch Dashboards. This allows you to use centrally configured Identity Center principals (users and groups) for accessing OpenSearch domains.

2. For OpenSearch Serverless, you can update the collection data access policy to include IAM Identity Center principals, granting them access to collections and indexes.

These integrations allow you to leverage your existing Identity Center setup for most of your OpenSearch access management, even though the initial master user needs to be an IAM principal.
Sources
IAM Identity Center Trusted Identity Propagation Support for Amazon OpenSearch Service - Amazon OpenSearch Service
IAM Identity Center support for Amazon OpenSearch Serverless - Amazon OpenSearch Service
Fine-grained access control in Amazon OpenSearch Service - Amazon OpenSearch Service