Why do I get an error message when I try to access my OpenSearch Service cluster?

Resolution

Your client doesn't support signing requests

If you use a client that doesn't support signing requests, then remove AWS Identity and Access Management (IAM) users or roles from your access policy. Then to allow unsigned requests to an OpenSearch Service domain, use an IP-based access policy.

OpenSearch Service uses CIDR block notation to check the IP address against the access policy. Make sure that you use CIDR block notation for the IP addresses that you specify in the access policy.

Check that you use the IP addresses from the access policy to access your cluster. Use checkip.amazonaws.com to see the public IP address of your local computer.

Note: If you receive an authorization error, then check whether you use a public or private IP address. You can't apply IP-based access policies to OpenSearch Service domains that are in a virtual private cloud (VPC). VPC security groups already enforce IP-based access policies. For more information, see About access policies on VPC domains.

If you have IAM roles mapped to backend fine-grained access control roles, then create fine-grained access control users with username and password and use basic authorization.

Your client supports signing requests

If your OpenSearch domain receives an un-signed authorization request, then you might get the following error message:

"User: anonymous is not authorized"

To resolve this error, sign in to OpenSearch with AWS Signature Version 4 (SigV4) for the IAM user or role in your cluster access policy or mapped to fine-grained access control roles.

Check that you specify the correct Amazon Resource Name (ARN) in the access policy.

If your OpenSearch Service domain is in a VPC, and you access your domain through a proxy server, then make sure that the proxy server correctly signs the request.

You can't access OpenSearch Dashboards

By default, web browsers don't sign requests. If you use a web browser to access OpenSearch Dashboards for a cluster that uses an IAM user or role in the domain access policy, then you might get the following error message:

"User: anonymous is not authorized"

To resolve this error, use a proxy to sign the requests or remove the IAM user or role from the domain access policy. To control access to OpenSearch Dashboards, use one of the following methods:

• Activate SAML authentication for Dashboards.
• Turn on Turn on fine-grained access control with HTTP basic authentication.
• Configure Amazon Cognito authentication for Dashboards.
• For public access domains, configure an IP-based access policy.
• For VPC access domains, use an open access policy and security groups to control access. For more information, see About access policies on VPC domains.