I really don’t know - you need to try and see how it works. I have different roles and users in Opendistro security plug-in and the user which connects and activates Elasticsearch APIs is a user which was defined with the permissions set similar to built-in user admin and as I said, it worked smoothly. When I tried to activate the same process which connects and deletes old indices based on age/size criteria with user which does not have the respective permissions, the connect method immediately failed with HTTP403, so, it really works as expected. My gut feeling - it will work for you but of course you need to test it.