Configuring roles and users

In OpenSearch, users have roles that define what they can do, and where. This article will demonstrate how to create a simple role and a user for submitting data into OpenSearch, and how to create a role and a user who can review the data in Dashboards.

Note that the roles and users defined below only scratch the surface of role and user definitions in OpenSearch. For details, consult the OpenSearch project's documentation.

Log in with the superuser account

Every ISaaS instance comes with a superuser account. This account should only be used for creating more specific roles, and never for day-to-day tasks like log shipping etc.

Create a user and role for submitting content

A role/user set up to submit content should never have more permissions than necessary. The role will limit what the user can do with which index(es).

Creating the logpusher user

In the menu, go to: Security → Internal users → Create internal user

• Username: logpusher
• Password: [create a suitable high quality password]

Creating the vectorlogger role

In the below example, we define a role named vectorlogger which is allowed to create and write to indexes mathing the pattern accesslog-*:

In the menu, go to: Security → Roles → Create Role

• Name: vectorlogger
• Cluster permissions
  • cluster:monitor/health
• Add index permissions
  • Index: accesslog-*
  • Index permissions
    • create_index
    • indices:admin/create
    • write

Map the user to the role

From the newly created vectorlogger role, select Mapped users and add the user logpusher from the dropdown list.

Create a user and role for viewing content

Note that the permissions granted for the role and user below will deny access to certain functions in OpenSearch Dashboards. If other permissions are required, another role with wider permissions should be created or the missing permissions must be added to this role.

Create a regular internal user

Create an internal user as was done for logpusher:

In the menu, go to: Security → Internal users → Create internal user

• Username: myuser
• Password: [create a suitable high quality password]

Create a read-only role

In the menu, go to: Security → Roles → Create Role

• Name: myrole
• Cluster permissions
  • cluster_composite_ops_ro
  • cluster:admin/opensearch/ql/datasources/read
  • cluster:admin/opensearch/observability/get
  • cluster:admin/opensearch/ppl
  • cluster:monitor/state
  • cluster:monitor/tasks/list
  • cluster:monitor/tasks/list*
• Index permissions:
  • Index: accesslog-*
    • get
    • read
  • Index: *
    • indices:monitor/settings/get
    • indices:admin/data_stream/get
    • indices:admin/resolve/index

Map the user to the role

From the newly created myrole role, select Mapped users and add the user myuser from the dropdown list.

Shipping data to your OpenSearch instance

Now that an account has been set up for submitting events to the instance, move on to Configuring log shippers.