Lambda to register manual snapshot repository



Im trying to automate the deployment of opensearch as well as setting up snapshots to s3 (we want to keep backups longer than 14 days)

Im currently running the opensearch cluster in cognito mode. But not sure how to configure boto3 auth.


3 Answers


Not sure what happened there, half my question got removed!

I am basing my lambda function on that code, and run the lambda via a role that has the iam:Passrole / ESHttpPut attached to it, How do i update the example script for using a role instead of a user?

Ie: update the below 2 lines to work with a role instead of user

credentials = boto3.Session().get_credentials()
awsauth = AWS4Auth(credentials.access_key, credentials.secret_key, region, service, session_token=credentials.token)

im looking at the boto3 docs and not seeing an option, but might be in the wrong place?!

Any help greatly appreciated

answered 2 years ago

If i just create a new IAM user with the IAM:PassRole setup it errors below, which looks like it needs opensearch access (aka has to be a cognito user!) But i dont understand how i could can set up a cognito user to have the specific policy? or how i you would have to re-write that script to run via cognito user?

{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [cluster:admin/repository/put] and User [name=arn:aws:iam::11111:user/manual-snapshot-reg, backend_roles=[], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [cluster:admin/repository/put] and User [name=arn:aws:iam::11111:user/manual-snapshot-reg, backend_roles=[], requestedTenant=null]"},"status":403}
answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions