OpenSearch:Access authorization rules

All OpenSearch applications that are created within your Alibaba Cloud account belong to the account. By default, an Alibaba Cloud account has full permissions on resources that belong to the account. OpenSearch allows you to use Resource Access Management (RAM) to grant RAM users the permissions to access and manage OpenSearch resources within your Alibaba Cloud account.

After you grant permissions to a RAM user or update the permissions of a RAM user, the granted or updated permissions take effect in 5 minutes.

If you want to use the OpenSearch console as a RAM user, you must grant the RAM user the required permissions. A common minimum permission set contains the permissions that are required to search for data in an application, view the application list, view application details, configure monitoring and alerting, and access an ApsaraDB RDS instance. The following sections describe these permissions for your reference.

Permissions to search for data in an application

If you want to use OpenSearch SDK to initiate a search request or test the document retrieval feature for an application as a RAM user, the RAM user must have the permissions to search for data in the application. The following sample code provides an example on the policy that grants the permissions required to retrieve documents from the application named app_schema_demo:

{
    "Statement": [
    {
            "Effect": "Allow",
            "Action": "opensearch:SearchApp",
            "Resource": "acs:opensearch:*:*:apps/app_schema_demo"
        }
    ],
    "Version": "1"
}

Permissions to view the application list

If you want to view applications after you log on to the OpenSearch console as a RAM user, the RAM user must have the permissions to view the list of applications.

{
    "Statement": [
        {
            "Action": [
                "opensearch:ListAppGroup",
                "opensearch:DescribeAppStatistics",
                "opensearch:ListAppGroupErrors"
            ],
            "Effect": "Allow",
            "Resource": "acs:opensearch:*:*:app-groups/*"
        }
    ],
    "Version": "1"
}

Permissions to view application details

The OpenSearch console provides the monitoring and alerting feature on the details pages of applications. If you want to view the details of an application in the OpenSearch console as a RAM user, the RAM user must have the permissions to view application details. The following sample code provides an example on the policy that grants the permissions required to view the details of the application named app_schema_demo:

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "opensearch:DescribeAppGroup",
                "opensearch:ListApp",
                "opensearch:DescribeApp"
            ],
            "Resource": "acs:opensearch:*:*:app-groups/app_schema_demo"
        },
        {
            "Action": "opensearch:ListUserAnalyzers",
            "Effect": "Allow",
            "Resource": "acs:opensearch:*:*:user-analyzers/*"
        }
    ],
    "Version": "1"
}

Permissions to configure monitoring and alerting

OpenSearch provides the monitoring and alerting feature based on the CloudMonitor service of Alibaba Cloud. The system policy AliyunCloudMonitorReadOnlyAccess grants the read-only permissions on CloudMonitor. You can search for this policy in the RAM console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "cms:Get*",
                "cms:List*",
                "cms:Query*",
                "cms:BatchQuery*"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "opensearch:DescribeApp",
            "Resource": "acs:opensearch:*:*:app-groups/*",
            "Effect": "Allow"
        }
    ]
}

Permissions to access an ApsaraDB RDS instance

OpenSearch can obtain data from an ApsaraDB RDS instance based on tables or fields. ApsaraDB RDS uses whitelists to implement access control. If you want to use OpenSearch to obtain data from an ApsaraDB RDS instance, you must grant the RAM user the permissions to configure a whitelist for the ApsaraDB RDS instance. Otherwise, when OpenSearch connects to the ApsaraDB RDS instance, an error occurs, indicating that the RAM user is not authorized to configure an IP address whitelist for the ApsaraDB RDS instance. You can grant permissions to a RAM user in the RAM console by performing the following steps: Follow the instructions on the Overview page to create a custom policy and a RAM user. Then, attach the policy to the RAM user on the Users page. For more information, see Use RAM to manage ApsaraDB RDS permissions. The following sample code provides an example on the policy that grants the permissions required to access an ApsaraDB RDS instance in OpenSearch:

• For information about the variables, such as $regionid, $accountid, and $dbinstanceid, in the Resource parameters, see Use RAM for resource authorization.

• You can use the wildcard (*) to set the variables in the Resource parameters.

  {
    "Version": "1",
    "Statement": [
        {
            "Action": "rds:DescribeDBInstanceAttribute",
            "Resource": "acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid",
            "Effect": "Allow"
        },
        {
            "Action": "rds:ModifySecurityIps",
            "Resource": "acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid",
            "Effect": "Allow"
        },
        {
            "Action": "rds:DescribeDBInstanceIPArrayList",
            "Resource": "acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid",
            "Effect": "Allow"
        },
        {
            "Action": "rds:DescribeDBInstanceNetInfoForChannel",
            "Resource": "acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid",
            "Effect": "Allow"
        }
    ]
  }

Permissions to call API operations

The following sample code provides an example on the policy that grants the permissions required to call API operations to search for data, push data, and access drop-down suggestion models.

{
	"Statement": [
	 {
	  "Effect": "Allow",
	  "Action": [
	   "opensearch:PushDoc",
	   "opensearch:SearchApp"
	  ],
	  "Resource": [
	   "acs:opensearch:$regionId:*:apps/$appGroupName",
	   "acs:opensearch:$regionId:*:app-groups/$appGroupName"
	  ]
	 },
	 {
	  "Action": "opensearch:SearchSuggest",
	  "Effect": "Allow",
	  "Resource": "acs:opensearch:$regionId:*:suggestions/$suggestionIdentity"
	 }
	],
	"Version": "1"
   }

Before you grant permissions to a RAM user, you must determine which permissions on which applications to grant. In most cases, if you use the OpenSearch console as a RAM user, you must grant the RAM user the permissions to perform the required actions. For example, you can grant the RAM user the permissions to perform the Describe* and List* actions. You can also grant a custom set of permissions to the RAM user as needed.

Example 1

You want to grant all permissions on all OpenSearch applications in all regions to a RAM user that belongs to an Alibaba Cloud account whose ID is 1234. In this case, you can use the Alibaba Cloud account to create a custom policy in the RAM console, and then attach the policy to the RAM user. You can also grant permissions to the RAM user by using RAM SDK. To grant permissions to a RAM user, perform the following steps: 1. Create a custom policy.

{
  "Statement": [
    {
      "Action": "opensearch:*",
      "Effect": "Allow",
      "Resource": "acs:opensearch:*:1234:apps/*"
    }
  ],
  "Version": "1"
}

2. Attach the policy to the RAM user.

Example 2

You want to grant all permissions on all OpenSearch applications in the China (Hangzhou) region to a RAM user that belongs to an Alibaba Cloud account whose ID is 1234. In this case, You can use the Alibaba Cloud account to create a custom policy in the RAM console, and then attach the policy to the RAM user. You can also grant permissions to the RAM user by using RAM SDK. To grant permissions to a RAM user, perform the following steps:

1. Create a custom policy.

{
  "Statement": [
    {
      "Action": "opensearch:*",
      "Effect": "Allow",
      "Resource": "acs:opensearch:cn-hangzhou:1234:apps/*"
    }
  ],
  "Version": "1"
}

2. Attach the policy to the RAM user.

When you use the OpenSearch console as a RAM user, an error message of failed RAM user authentication may appear, as shown in the following figure. To resolve this error, perform the following steps:

• View the details of the error message to find the POP action in the request. In this example, the POP action is ListAppGroups. If the POP action ends with DryRun, ignore DryRun. For example, if the POP action is CreateAppDryRun, the actual action is CreateApp.

• In the Authorization rules of applications topic, find the RAM action and the value format of the Resource parameter that correspond to the ListAppGroups POP action.

  In most cases, the RAM action is different from the POP action.

• Configure a custom policy to grant the required permissions on the RAM action to the RAM user.