How do I troubleshoot the 403 exception error in OpenSearch Service?

Resolution

Index creation block exception error

If you don't have enough storage space or you have high JVM memory pressure, then you might get the following error message:

{ 
 "error": { 
 "root_cause": [{ 
 "type": "index_create_block_exception", 
 "reason": "blocked by: [FORBIDDEN/10/cluster create-index blocked (api)];" 
  }], 
 "type": "index_create_block_exception", 
 "reason": "blocked by: [FORBIDDEN/10/cluster create-index blocked (api)];" 
  }, 
 "status": 403 
}

To troubleshoot storage issues, see Lack of available storage space.

To troubleshoot high JVM memory pressure issues, see How do I troubleshoot high JVM memory pressure on my Amazon OpenSearch Service cluster?

Cluster block exception error

Your cluster is in read-only state

If you set the read-only block to true, then you might get the following error message:

{ 
 "error" : { 
 "root_cause" : [ 
 { 
 "type" : "cluster_block_exception", 
 "reason" : "blocked by: [FORBIDDEN/6/cluster read-only (api)];", 
 } 
  ], 
 "type" : "cluster_block_exception", 
 "reason" : "blocked by: [FORBIDDEN/6/cluster read-only (api)];", 
 }, 
 "status" : 403 
}

To check if you set the read-only state to true, see Cluster in read-only state.

Your cluster is in warm storage

If you try to add, update, or delete individual documents in the warm indexes, then you might get the following error message:

{ 
"error" : { 
 "root_cause" : [
{ 
 "type" : "cluster_block_exception", 
 "reason" : "blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];",
}
], 
 "type" : "cluster_block_exception", 
 "reason" : "blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];",
 }, 
 "status" : 403 
} 

Warm indexes are read-only unless you return them to hot storage. You can query the indexes and delete them only if they're present in the UltraWarm storage. To update documents, you must migrate the index from UltraWarm storage to hot storage.

Related information

How can I scale up or scale out an Amazon OpenSearch Service domain?