Unable to access the New OpenSearch UI (Dashboards)

Hello.

It may not be directly related, but please also check the resource-based policy for the OpenSearch service.
If this is set to Deny, you will get a 403 error even if the action is permitted on the IAM user side.
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html

The 403 Forbidden error you're encountering when trying to access OpenSearch Dashboards typically occurs due to IAM permission issues or incorrectly signed requests.

Even though you mentioned having the required permissions, please verify that your IAM identity includes the aoss:DashboardsAccessAll and aoss:APIAccessAll actions in its permissions policy. These specific actions are required for accessing OpenSearch Dashboards and OpenSearch Serverless data plane APIs.

Additionally, if you enable verbose logging in your client or check the Network tab in your browser's developer tools, you might see additional error details that can help pinpoint the issue.

If your IAM permissions are correctly configured and you're still experiencing the 403 error, the issue could be related to:

1. Network policy restrictions - Ensure that your network policy allows access to the OpenSearch Serverless APIs and dashboard. If you're accessing from the public internet, verify that public access is enabled in the network policy. For private access, you'll need to create a VPC endpoint.

2. Incorrectly signed requests - Review how your client is interacting with the OpenSearch APIs. You can test endpoint access using AWS CLI or tools like curl or awscurl to verify the request signing is correct.

Make sure to double-check both your IAM permissions policy and network policy settings, as both are required for successful access to OpenSearch Dashboards.
Sources
Troubleshoot OpenSearch Serverless errors | AWS re:Post

Hello. To resolve the "403 Forbidden" issue, I suggest you to add the following IAM policy to your application admin role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "OpenSearchApplicationAccess",
            "Effect": "Allow",
            "Action": [
                "opensearch:ApplicationAccessAll"
            ],
            "Resource": "*"
        }
    ]
}

You will proceed with implementing the policy and verify if this resolves the access issue.