# Limit access for a role to a specific tenant/index/view

**URL:** <https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210>\
**Category:** Security\
**Tags:** configure\
**Created:** [May 5, 2023, 5:20am UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210 "2023-05-05T05:20:22Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![B3n](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@B3n](https://forum.opensearch.org/u/B3n)\
**Post date:** [May 5, 2023, 5:20am UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/1 "2023-05-05T05:20:22Z")

</div>

**Versions** :  
OpenSearch: 2.7.0  
OpenSearch Dashboard: 2.7.0  
Running both in docker-compose.  
Only log ingestion is being used so far (fluent-bit → data-prepper → opensearch)

**Describe the issue** :  
Hello together,

i do have two questions:

**1. Tenants**

I have activated tenants within my setup and i found out how to limit a role to a specific tenant.  
E.g. by using:

```auto
   tenant_permissions:
     - tenant_patterns:
         - 'tenant_name'

```

But i did not find out how to move an existing index to this tenant, so only the role with access to that tenant can actually access the index with _tenant\_name_.  
Also: How can i specify from the log sending part (data-prepper) to which index/tenant the data should be sent?

**2. Principle of least privilege**

I do have a role, which is used within the example above:

```auto
g_63_read_only:
  reserved: false
  hidden: false
  cluster_permissions:
    - 'cluster_composite_ops'
    - 'indices_monitor'
  index_permissions:
    - index_patterns:
        - 'g_63_*'
        - '.kibana'
      dls: ''
      fls: []
      masked_fields: []
      allowed_actions:
        - 'read'
  tenant_permissions:
    - tenant_patterns:
        - 'global_tenant'
      allowed_actions:
        - 'kibana_all_read'
  static: false

```

By using the _Discover_ tab, that role is only able to access and see data inside the index with the name g\_63\_\*, as this is the main purpose for this role. But it also sees other indexes, without being able to access them as a _Forbidden_ message is appearing. (I’m still confused btw. that i have to use _.kibana_ to make the view possible for this role, i guess it is a migration “feature”)

Is it possible to not display/hide the other indexes for this role? (This is also something i wanted to achieve by using tenants)

Also: Is it possible for that role to not display all the others: Obervability/OpenSearch Plugins/Management? I would love to have that in e.g. a config as i’m stateless, and i do not want to configure it again when setting up docker-compose.

Thanks a lot! 🙂

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 5, 2023, 8:50am UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/2 "2023-05-05T08:50:34Z")

</div>

@B3n As per documentation, tenants are designed to separate OpenSeach Dashboards objects i.e. dashboards, visualisations, index patterns etc.

[https://opensearch.org/docs/latest/security/multi-tenancy/tenant-index/](https://opensearch.org/docs/latest/security/multi-tenancy/tenant-index/)

Tenants do not control access to OpenSearch indexes. This is controlled by security roles.  
OpenSearch indices can’t be assigned to OpenSearch Dashboards tenants.

If the user has two tenants assigned in a single role with the index permission, that index permission will affect both tenants. The same applies if the user has two separate roles, one for each tenant. The index permissions in all those roles would apply to all assigned tenants.

> [@B3n](#):
>
> By using the _Discover_ tab, that role is only able to access and see data inside the index with the name g\_63\_\*, as this is the main purpose for this role. But it also sees other indexes, without being able to access them as a _Forbidden_ message is appearing. (I’m still confused btw. that i have to use _.kibana_ to make the view possible for this role, i guess it is a migration “feature”)
> 
> Is it possible to not display/hide the other indexes for this role? (This is also something i wanted to achieve by using tenants)

.kibana index is leftover after OpenDistro which was based on Elasticsearch and Kibana. This doesn’t affect the functionality of the OpenSearch in any way is only a cosmetic issue.

Have you tried to use `do_not_fail_on_forbidden`?

> **[Multi-tenancy configuration](https://opensearch.org/docs/latest/security/multi-tenancy/multi-tenancy-config/)**
>
> Multi-tenancy configuration

The current security plugin can’t control other modules’ appearance in the OpenSearch Dashboards. The only available option that can limit the OpenSearch Dashboards view is `opensearch_security.readonly_mode.roles`. This must be set in the opensearch\_dashboards.yml file.

[https://opensearch.org/docs/latest/security/access-control/users-roles/](https://opensearch.org/docs/latest/security/access-control/users-roles/)

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/c/c7f202cce203bc86683c3913300fe9d1ea691bd1.png)

![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/8/806c72e9ce23be3393f32091e32aff471fa3ffe9.png)

---

<div class="post-metadata">

**Author:** ![B3n](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@B3n](https://forum.opensearch.org/u/B3n)\
**Post date:** [May 5, 2023, 11:06am UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/3 "2023-05-05T11:06:33Z")

</div>

Hey @pablo, thanks a lot for your input!

Okay so tenants would’nt be useful in my case and i might deactivate them.

I was actually using _do\_not\_fail\_on\_forbidden: true_ in my config:

```auto
config:
  dynamic:
    do_not_fail_on_forbidden: true

```

But it did not had any effect or the role (see above) was to migthy.

What i now did, is the following in my opensearch-dashboards.yml:

> opensearch\_security.readonly\_mode.roles: [“g\_63\_read\_only”]

That worked any now i only can see exactly what you’ve posted in your screenshot.

Thanks a lot already for this! Do you know what kind of rights i need to give the role to see the Discovery and access the Index g\_64\_\*?

Thank you!

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 5, 2023, 1:03pm UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/4 "2023-05-05T13:03:26Z")

</div>

@B3n You can start with read permission or test indices:data/read variations.

> [@B3n](#):
>
> By using the _Discover_ tab, that role is only able to access and see data inside the index with the name g\_63\_\*, as this is the main purpose for this role. But it also sees other indexes, without being able to access them as a _Forbidden_ message is appearing.

What do you mean by `other indices`? Do you mean all indices starting with `g_63_` or all remaining indices in the cluster?

---

<div class="post-metadata">

**Author:** ![B3n](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@B3n](https://forum.opensearch.org/u/B3n)\
**Post date:** [May 8, 2023, 5:31am UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/5 "2023-05-08T05:31:06Z")

</div>

@pablo i’m now with:

_opensearch\_security.readonly\_mode.roles: [“g\_63\_read\_only”]_ inside my opensearch-dashboards.yml

where my role looks like the following:

```auto
g_63_read_only:
  reserved: false
  hidden: false
  cluster_permissions:
    - 'cluster_composite_ops_ro'
  index_permissions:
    - index_patterns:
        - 'g_63_*'
        - '.kibana'
      dls: ''
      fls: []
      masked_fields: []
      allowed_actions:
        - 'indices:data/read'
  static: false

```

But it seems like when i’m using _opensearch\_security.readonly\_mode.roles_ with that role, i can add index permissions/cluster\_permissions as much as i want, it will only show the Dashboard or e.g. the screenshot you’ve posted. The Discover tab is not being shown.

> What do you mean by `other indices` ? Do you mean all indices starting with `g_63_` or all remaining indices in the cluster?

I mean all the remaining indices. As for example i have different sources where i’m getting data from data-prepper and i want to seperate each of them.

Like:

1. Data-Prepper client (dedicated virtual machine) sends logs to index: **g\_63\_dev\_logs**
2. Data-Prepper client (dedicated virtual machine) sends logs to index: **g\_53\_dev\_logs**

and so on. So my plan is, to have the role _g\_63\_read\_only_ only being able to see the Discover and to access the data inside g\_63\_dev\_logs.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 9, 2023, 5:06pm UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/6 "2023-05-09T17:06:05Z")

</div>

@B3n `opensearch_security.readonly_mode.roles` only limits the OpenSearch Dashboards UI to the Dashboards module. There are no other index permissions assigned.

There is no option or permission that would allow seeing only Discovery in OpenSearch Dashboards UI.

The role is correct and will let only read the indices declared in the index\_patterns.

---

<div class="post-metadata">

**Author:** ![B3n](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@B3n](https://forum.opensearch.org/u/B3n)\
**Post date:** [May 11, 2023, 4:46am UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/7 "2023-05-11T04:46:37Z")

</div>

@pablo so basically that means that my usecase is not possible, right?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 15, 2023, 1:40pm UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/8 "2023-05-15T13:40:51Z")

</div>

> [@B3n](#):
>
> So my plan is, to have the role _g\_63\_read\_only_ only being able to see the Discover and to access the data inside g\_63\_dev\_logs.

> [@B3n](#):
>
> @pablo so basically that means that my usecase is not possible, right?

Yes, you’re correct.

---

<div class="post-metadata">

**Author:** ![hm21](https://avatars.discourse-cdn.com/v4/letter/h/8dc957/32.png) [@hm21](https://forum.opensearch.org/u/hm21)\
**Post date:** [February 18, 2024, 2:48pm UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/9 "2024-02-18T14:48:00Z")

</div>

> [@pablo](#):
>
> > [@B3n](#):
> >
> > By using the _Discover_ tab, that role is only able to access and see data inside the index with the name g\_63\_\*, as this is the main purpose for this role. But it also sees other indexes, without being able to access them as a _Forbidden_ message is appearing.
> 
> What do you mean by `other indices`? Do you mean all indices starting with `g_63_` or all remaining indices in the cluster?

Have the same situation. Users can view/search all existing indices, but access the indices I gave them the needed permissions for. When a user clicks on a index they do not have permission for then “SecurityException” comes up:

```auto
[security_exception] no permissions for [indices:admin/get] and User [name=test_user, backend_roles=[], requestedTenant=]

```

Example:

I have the following role:

```auto
resource "opensearch_role" "writer" {
  role_name = "logs_writer"
  description = "Logs writer role"

  cluster_permissions = [
    "cluster:monitor/state", "cluster:monitor/health" // Minimal cluster permission required to access OpenSearch
  ]

  index_permissions {
    index_patterns = ["security*"]
    allowed_actions = ["*"] // Added the required permission
  }

```

The mappings:

```auto
# Create a role mapping
resource "opensearch_roles_mapping" "writer_mapper" {
  role_name = "logs_writer"
  description = "Mapping write roles to OS role"
  users = ["test_user"]
}

resource "opensearch_roles_mapping" "kibana_user" {
  role_name = "kibana_user"
  description = "Mapping kibana_user to user"
  users = ["test_user"]
}

```

the following sets are set to true:

```auto
    do_not_fail_on_forbidden: true
    do_not_fail_on_forbidden_empty: true

```

Now a screenshot showing what the “test\_user” user can see in “Indices Table”

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/0df4edd607d1986af6abf265229b648d9ee33853.png)

Now, when typing “opensearch” in the search bar:

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/7/70e5fb75cc6fde8708348353e9f0cf4674b8f6f1.png)

I did not give “test\_user” permissions to see them right? When clicking on one of the indices in the screenshot. I get following security\_exception:

![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/982cfdfd14461dc98248c9252ca2fc60e9361b06.png)

Yep, that’s also correct, but the final question comes here:

How to restrict that Users can’t view/search all indices, but only the indices they have the needed permissions for? @pablo

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [February 29, 2024, 3:31pm UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/10 "2024-02-29T15:31:09Z")

</div>

@hm21 These are minium permissions required to list indices in the reported view.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/3540cb867ce1ff9a249f11ceac61edae26b28ef6.png)

However, this only allows me to list them. If I click on any of those and I don’t have permissions assigned then I’ll see the following error.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/c/ccf9561484aac5f0bd5c06cd5dd5e5850f702f98.png)

---

<div class="post-metadata">

**Author:** ![hm21](https://avatars.discourse-cdn.com/v4/letter/h/8dc957/32.png) [@hm21](https://forum.opensearch.org/u/hm21)\
**Post date:** [February 29, 2024, 9:48pm UTC](https://forum.opensearch.org/t/limit-access-for-a-role-to-a-specific-tenant-index-view/14210/11 "2024-02-29T21:48:54Z")

</div>

@pablo What happens when you remove the “index permissions”? Would you still be able to “list” all indices?