# Indices:data/write/bulk Permission Error

**URL:** <https://forum.opensearch.org/t/indices-data-write-bulk-permission-error/22828>\
**Category:** OpenSearch Dashboards\
**Tags:** troubleshoot\
**Created:** [December 17, 2024, 10:41am UTC](https://forum.opensearch.org/t/indices-data-write-bulk-permission-error/22828 "2024-12-17T10:41:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pizzaman](https://avatars.discourse-cdn.com/v4/letter/p/ee7513/32.png) [@pizzaman](https://forum.opensearch.org/u/pizzaman)\
**Post date:** [December 17, 2024, 10:41am UTC](https://forum.opensearch.org/t/indices-data-write-bulk-permission-error/22828/1 "2024-12-17T10:41:19Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
v2.15

**Describe the issue** :  
We are controlling permissions to provide each user with a custom tenant for each project,  
but when a user connects to a tenant with a role like the one below, there are cases where the error mentioned in the issue occurs and cases where it does not.  
Why does it happen when accessing Discovery or Home?

Through the backend\_roles shown in the following log, we create two tenants and allow users to access the two custom tenants,  
even though we connected the same role configuration, one side has an error and the other side does not.

**Configuration** :

```auto
            "cluster_permissions": [
                "cluster:admin/opensearch/ql/datasources/read",
                "indices:data/read/mget"
            ],
            "index_permissions": [
                {
                    "index_patterns": {tenant_name}-*,
                    "dls": "",
                    "fls": [],
                    "masked_fields": [],
                    "allowed_actions": ["read"]
                }
            ],
            "tenant_permissions": [
                {
                    "tenant_patterns": [f"{tenant_name}"],
                    "allowed_actions": ["kibana_all_read", "kibana_all_write"],
                }
            ],

```

**Relevant Logs or Screenshots** :  
Dec 17 19:38:11 opensearch-dashboards[2566944]: {“type”:“log”,“@timestamp”:“2024-12-17T10:38:11Z”,“tags”:[“error”,“opensearch”,“data”],“pid”:2566944,“message”:“[security\_exception]: no permissions for [indices:data/write/bulk] and User [name=dev, backend\_roles=[raycluster, test-raycluster], requestedTenant=raycluster]”}

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [December 19, 2024, 11:46am UTC](https://forum.opensearch.org/t/indices-data-write-bulk-permission-error/22828/2 "2024-12-19T11:46:48Z")

</div>

Hi @pizzaman,

Is there a particular action that triggers the error?

Could you share the outputs of the below:

```auto

curl --insecure -u <admin_username>:<admin_password> -XGET https://<OpenSearch_node_FQDN_or_IP>:9200/_plugins/_security/api/roles/raycluster

```

```auto
curl --insecure -u <admin_username>:<admin_password> -XGET https://<OpenSearch_node_FQDN_or_IP>:9200/_plugins/_security/api/roles/test-raycluster

```

```auto
curl --insecure -u <admin_username>:<admin_password> -XGET https://<OpenSearch_node_FQDN_or_IP>:9200/_plugins/_security/api/rolesmapping?pretty

```

Best,  
mj

---

<div class="post-metadata">

**Author:** ![cwperks](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/cwperks/32/4968_2.png) [@cwperks](https://forum.opensearch.org/u/cwperks)\
**Post date:** [December 20, 2024, 1:16am UTC](https://forum.opensearch.org/t/indices-data-write-bulk-permission-error/22828/3 "2024-12-20T01:16:37Z")

</div>

This is one of the nuances of the opensearch security model `indices:data/write/bulk` is considered a `cluster_permission`. Make sure that one of the roles that the user is mapped to contains this in the `cluster_permissions` section.

The reason it is a cluster permission is because a bulk action is composed of individual actions and not directly itself connected to indices. When authorizing a bulk request the individual items of the bulk requests are all independently authorized. By adding `indices:data/write/bulk` to the `cluster_permissions` of a role you are basically saying that the role is capable of perform a `_bulk` request.