OpenSearch Console can't access indices or clusters. Root user arn-iam has already been added to "all_access" role in OpenSearch Dashboard
I followed all the articles and answers from Q.
I was able to grant access to some Lambda Functions by adding the IAM-Roles as mapped backend roles.
However, the AWS OpenSearch console can't access the cluster or indices data without regard to having added the root user to "all_access" mapped backend roles.
Mapped backend users:
AWS OpenSearch Console:
- Newest
- Most votes
- Most comments
Try below to locate the problem:
- Confirm Role Mapping • Go to OpenSearch Dashboards > Security > Roles > all_access • Under Mapped users, ensure the exact ARN of your IAM user/role is listed
arn:aws:iam::123456789012:user/your-admin-user
• If you’re using federated login (e.g. Cognito or SAML), map the backend role instead
-
Check Domain Access Policy • In the AWS Console, go to OpenSearch Service > Your Domain > Permissions • Make sure the domain access policy allows your IAM principal to perform es:* actions on the domain
-
Use Dev Tools to Verify Access In OpenSearch Dashboards, go to Dev Tools and run:
GET _plugins/_security/authinfo
Hey,
Hope you're keeping well.
When you access the domain from the AWS OpenSearch Service console, the request is made using your IAM user or role through SigV4 signing, so the domain’s resource-based access policy must explicitly allow that principal. Mapping the IAM ARN to all_access in OpenSearch Dashboards only controls permissions once you’re inside the cluster, but if the domain policy blocks the call the console won’t reach that stage. Go to OpenSearch Service > your domain > Access policy and ensure your IAM root user ARN is listed with "es:*" permissions on the domain ARN.
Thanks and regards,
Taz
answered 8 months ago
