How to set up IAM role to access AWS OpenSearch Service domain through terraform

Question

I have an OpenSearch domain deployed in AWS and want to manage it through Terraform provider. I have the following provider block. How do I set up an IAM role that can be used to access this domain through Terraform?

```
provider "opensearch" {
  aws_region = ""
  aws_profile = ""
  healthcheck = true
  url = ""
  sign_aws_requests = false
  aws_assume_role_arn = ""
}
```
I have tried by creating a role with the following trust policy and admin privileges, and added this role to the provider.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "es.amazonaws.com",
                "AWS": "arn:aws:iam:::root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {}
        }
    ]
}
```
But this does not work and gives me │ Error: elastic: Error 401 (Unauthorized) when I do terraform apply.

Ravid_G · Answer

You can use the AWS Policy generator - https://awspolicygen.s3.amazonaws.com/policygen.html.
Choose IAM policy and add the relevant information in order to create the policy.

Sean Nixon · Answer

There are a few things you can check:

1. Ensure that the user or role associated with the `aws_profile` set in your provider has `sts:AssumeRole` permission on the role you created.
2. The provider configuration you posted is explicitly disabling signing of AWS requests. [This setting is intended for using HTTP Basic Auth](https://registry.terraform.io/providers/opensearch-project/opensearch/latest/docs#http-basic-auth). I recommend configuring your opensearch provider with `sign_aws_requests = true` for use with IAM authentication.
3. If you have [Fine-Grained Access Control ](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html) enabled and the role you are using is not set as the master user, you may need to [add a role mapping](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html#fgac-mapping) for the role you are trying to use.

How to set up IAM role to access AWS OpenSearch Service domain through terraform

Relevant content