403 Forbidden on OpenSearch Serverless document indexing, despite full access policies

Question

I'm consistently receiving 403 Forbidden errors when trying to index documents into a new OpenSearch Serverless collection, even though I've verified all IAM and AOSS policies are correctly configured.

IAM identity policy:

{
  "Effect": "Allow",
  "Action": [
    "aoss:APIAccessAll",
    "aoss:ListCollections",
    "aoss:GetAccessPolicy"
  ],
  "Resource": "*"
}

AOSS data access policy

{
  "Rules": [
    {
      "Resource": ["collection/test-chatbot"],
      "Permission": ["aoss:*"],
      "ResourceType": "collection"
    },
    {
      "Resource": ["index/test-chatbot/*"],
      "Permission": ["aoss:*"],
      "ResourceType": "index"
    }
  ],
  "Principal": [
    "arn:aws:iam::123456789012:user/opensearch-serverless-test"
  ]
}

[
  {
    "Rules": [
      {
        "Resource": ["collection/test-chatbot"],
        "ResourceType": "collection"
      },
      {
        "Resource": ["collection/test-chatbot"],
        "ResourceType": "dashboard"
      }
    ],
    "AllowFromPublic": true
  }
]

Observed Behavior
-All document indexing (POST /test_index/_doc) fails with 403 Forbidden
-Tried multiple new index names
-Confirmed IAM identity via CLI
-Verified data access policy includes correct principals

Console UI also fails with error:
Cannot read properties of undefined (reading 'docs.count')

re:Post Agent · Answer

Based on the information provided, there are a few potential issues causing your 403 Forbidden errors when trying to index documents into your OpenSearch Serverless collection.

The most likely issue is that your IAM policy is missing the required `aoss:DashboardsAccessAll` permission. According to AWS documentation, a principal must have both `aoss:APIAccessAll` and `aoss:DashboardsAccessAll` permissions to properly access OpenSearch Serverless collections. Without both of these permissions, you'll receive 403 errors when attempting to send requests to the collection, even if your data access policy is correctly configured.

Your current IAM policy includes:
- `aoss:APIAccessAll`
- `aoss:ListCollections`
- `aoss:GetAccessPolicy`

But it's missing the critical `aoss:DashboardsAccessAll` permission.

Additionally, for index-specific operations, make sure that your data access policy contains the correct permissions for both the collection and index resources, and that the policy contains the correct IAM identity in the Principal section. Double-check that the ARN in your Principal section matches exactly with the IAM user you're using.

For the network policy, ensure that "Enable access to OpenSearch Dashboards" is turned on if you're trying to access it from the public internet. This setting is disabled by default and could be contributing to your access issues.

If you're still experiencing issues after adding the missing permission, verify that your requests include the correct API version and resource name in your requests to the endpoint.  
**Sources**  
[Troubleshoot OpenSearch Serverless errors | AWS re:Post](https://repost.aws/knowledge-center/opensearch-serverless-troubleshoot)  
[Getting a 401 when trying to access OpenSearch serverless dashboard | AWS re:Post](https://repost.aws/questions/QUrOZGnwlHRMSLQoSePGuShg/getting-a-401-when-trying-to-access-opensearch-serverless-dashboard)  
[Data access control for Amazon OpenSearch Serverless - Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html)  
[AuthorizationException(403, 'Forbidden') | AWS re:Post](https://repost.aws/questions/QUi7Ljsk3ORQ6OnQbdzsQuCA/authorizationexception-403-forbidden)

403 Forbidden on OpenSearch Serverless document indexing, despite full access policies

Add your answer

Relevant content