Access denied (403) when creating an index in OpenSearch Serverless.

Question

I am trying to create a minimal working example for working with AWS OpenSearch Serverless. With the help of [this][1] tutorial, this is the code:

```py
import boto3
from opensearchpy import OpenSearch, RequestsHttpConnection, AWSV4SignerAuth

host = 'onb565zzbfkjr3spn8v5.us-east-1.aoss.amazonaws.com'
region = 'us-east-1'

credentials = boto3.Session().get_credentials()
auth = AWSV4SignerAuth(credentials, region)
client = OpenSearch(
    hosts = [{
        'host': host,
        'port': 443
    }],
    http_auth = auth,
    use_ssl = True,
    verify_certs=True,
    connection_class = RequestsHttpConnection
)

def create_index(index_name):
    index_body = {
      'settings': {
        'index': {
          'number_of_shards': 1
        }
      }
    }
    response = client.indices.create(index_name, body=index_body)
    print('
Creating index:')
    print(response)

create_index('myindex')
```

I have performed the following steps:

1. Created an IAM user that has the policies `AmazonOpenSearchServiceFullAccess` and `AmazonESFullAccess` (just in case). I also added two inline policies:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "aoss:APIAccessAll",
            "Resource": "*"
        }
    ]
}
```

and

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "aoss:DashboardsAccessAll",
            "Resource": "*"
        }
    ]
}
```

(for some reason, the latter two permissions are not shown when I create a collection)

2. Executed `aws configure` to provide the keys and the region.

3. Created a collection with the rule for `Public` access, the IAM user as the selected principal, and all accesses enabled.

Despite all this, I get 403 (Access denied) when trying to create an index. What could I be missing?

P.S. I had previously posted this question in [StackOverflow](https://stackoverflow.com/q/76649409/2725810).

[1]: https://youtu.be/SUVjrOKYVVk

Edward_S · Answer

You also need to create a [data access policy](https://catalog.us-east-1.prod.workshops.aws/workshops/f8d2c175-634d-4c5d-94cb-d83bbc656c6a/en-US/21-security-overview/21-03-data) in OpenSearch Serverless to allow access to the collections and indexes

**Example Policy from [Overview of security in Amazon OpenSearch Serverless](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-security.html#serverless-security-data-access)**
```
[
   {
      "Rules":[
         {
            "ResourceType":"index",
            "Resource":[
               "index/marketing/orders*"
            ],
            "Permission":[
               "aoss:*"
            ]
         }
      ],
      "Principal":[
         "arn:aws:iam::123456789012:user/Dale",
         "arn:aws:iam::123456789012:role/RegulatoryCompliance",
         "saml/123456789012/myprovider/user/Annie"
      ]
   }
]
```

References:
* https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-security.html#serverless-security-data-access
* https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html

Also make sure your IAM user credentials are either stored in the *default* profile or provide ```boto3.Session``` with the ***profile_name***, https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html#shared-credentials-file

David Neale · Answer

I also had this issue and I don't believe that the suggested fixes would have solved the OP's problem.

The signer that is created is defaulting to signing requests for the `es` service (elastic search) which isn't correct for serverless.

Altering the auth line to `auth = AWSV4SignerAuth(credentials, region, 'aoss')` fixed it for me.

Access denied (403) when creating an index in OpenSearch Serverless.

Relevant content