0

I am running my code in AWS Lambda to push data into AWS OpenSearch. I have provided full permissions (es:* and aoss:*) for the user whose credentials I am using to PUT/DELETE data into OpenSearch. But, I am getting the following error...

    {
    "name": "ResponseError",
    "meta": {
        "body": {
            "error": {
                "root_cause": [
                    {
                        "type": "security_exception",
                        "reason": "Authorization failure for the following indices: [trip-list]"
                    }
                ],
                "type": "security_exception",
                "reason": "Authorization failure for the following indices: [trip-list]"
            },
            "status": 403
        },
        "statusCode": 403,
        "headers": {
            "date": "Sun, 09 Jul 2023 16:13:35 GMT",
            "content-type": "application/json; charset=UTF-8",
            "content-length": "241",
            "x-envoy-upstream-service-time": "75",
            "server": "aoss-amazon-i",
            "x-request-id": "143de425-85d0-9851-9d8f-406091505e0d"
        },
        "meta": {
            "context": null,
            "request": {
                "params": {
                    "method": "PUT",
                    "path": "/trip-list/_doc/34c41782-21ed-4bdf-8900-2e1847d63080",
                    "body": "{\"id\":\"34c41782-21ed-4bdf-8900-2e1847d63080\",\"a\":\"US_Mexico_Trip\",\"b\":2000,\"c\":20230706113628772}",
                    "querystring": "",
                    "headers": {
                        "user-agent": "opensearch-js/1.2.0 (linux 4.14.255-311-248.529.amzn2.x86_64-x64; Node.js v18.16.0)"
                    },
                    "timeout": 30000
                },
                "options": {},
                "id": 1
            },
            "name": "opensearch-js",
            "connection": {
                "url": "https://xxxxxxxxxxxxx.eu-west-1.aoss.amazonaws.com/",
                "id": "https://xxxxxxxxxxxxx.eu-west-1.aoss.amazonaws.com/",
                "headers": {},
                "deadCount": 0,
                "resurrectTimeout": 0,
                "_openRequests": 0,
                "status": "alive",
                "roles": {
                    "master": true,
                    "data": true,
                    "ingest": true
                }
            },
            "attempts": 0,
            "aborted": false
        }
    }
}

Following is the code I have written in Lambda

import AWS from 'aws-sdk';

import { Client } from "@opensearch-project/opensearch";
import { AwsSigv4Signer } from '@opensearch-project/opensearch/aws';
export const handler = async (event) => {

    AWS.config.update({
        accessKeyId: "xxxxxxxxxxxxx",
        secretAccessKey: "xxxxxxxxxxxxx"
    });

    const client = new Client({
        ...AwsSigv4Signer({
            region: 'eu-west-1',
            service: 'aoss',
            getCredentials: () =>
                new Promise((resolve, reject) => {

                    AWS.config.getCredentials((err, credentials) => {
                        if (err) {
                            reject(err);
                        } else {
                            resolve(credentials);
                        }
                    });
                }),
        }),
        node: 'https://xxxxxxxxxxxxx.eu-west-1.aoss.amazonaws.com', // OpenSearch domain URL
    });


    var index_name = "trip-list";

    for (const record of event.Records) {
        const eventName = record.eventName;
        const dynamodbItem = AWS.DynamoDB.Converter.unmarshall(record.dynamodb.NewImage);

        if (eventName === 'INSERT' || eventName === 'MODIFY') {
            const PK = dynamodbItem.PK;
            const SK = dynamodbItem.SK;
            const a = dynamodbItem.a
            const b = dynamodbItem.b
            const c = dynamodbItem.c;

            // Create an Elasticsearch document from the extracted data
            const document = {
                id: SK,
                a,
                b,
                c
            };

            try {
                var response = await client.index({
                    id: SK,
                    index: index_name,
                    body: document
                });
                console.log("UPDATED SUCCESSFULLY -> ")
                console.log(response)
            } catch (error) {
                console.error('Error indexing document:');
                console.error(JSON.stringify(error))
            }

        } else if (eventName === 'REMOVE') {
            const SK = dynamodbItem.SK;

            // Delete the corresponding document from Elasticsearch
            try {
                var response = await client.delete({
                    index: index_name,
                    id: SK
                });
                console.log('Document deleted successfully:', JSON.stringify(response));
            } catch (error) {
                console.error('Error deleting document:');
                console.error(JSON.stringify(error))
            }
        }
    }
}

The role which is assigned to Lambda has also been given full permission (es.* and aoss.*). Then, why am I still getting Authorization failure for the following indices: [trip-list].

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
StackAddict
  • 423
  • 9
  • 21

0 Answers0