# Multitenancy - Removing non-admin users access to Global Tenant

**URL:** <https://forum.opensearch.org/t/multitenancy-removing-non-admin-users-access-to-global-tenant/17964>\
**Category:** OpenSearch Dashboards\
**Tags:** security-issue\
**Created:** [February 19, 2024, 3:28pm UTC](https://forum.opensearch.org/t/multitenancy-removing-non-admin-users-access-to-global-tenant/17964 "2024-02-19T15:28:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vmm-afonso](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vmm-afonso](https://forum.opensearch.org/u/vmm-afonso)\
**Post date:** [February 19, 2024, 3:28pm UTC](https://forum.opensearch.org/t/multitenancy-removing-non-admin-users-access-to-global-tenant/17964/1 "2024-02-19T15:28:54Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
Opensearch/Opensearch-Dashboards v2.11.1

**Describe the issue** :  
Trying to figure out a way to remove non-admin users access to Global Tenant here. I only found a way to remove Global tenant access from every user (admin included) through the config “opensearch\_security.multitenancy.tenants.enable\_global: false” on opensearch\_dashboards.yml file.

Or if not possible, I suppose a way to give read-only access to Global tenant? Not optimal but I can live with that for now

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![hm21](https://avatars.discourse-cdn.com/v4/letter/h/8dc957/32.png) [@hm21](https://forum.opensearch.org/u/hm21)\
**Post date:** [February 19, 2024, 5:41pm UTC](https://forum.opensearch.org/t/multitenancy-removing-non-admin-users-access-to-global-tenant/17964/2 "2024-02-19T17:41:49Z")

</div>

When no permissions are granted to users, they shouldn’t be able to read anything in the global tenant. The may be able to select and enter it when asked but not have access anything.

E.g.: the following role in tf would grant access to the global\_tenant

```auto
resource "opensearch_role" "writer" {
  role_name = "logs_writer"
  description = "Logs writer role"

  cluster_permissions = ["*"]

  index_permissions {
    index_patterns = ["logstash-*"]
    allowed_actions = ["write"]
  }

  tenant_permissions {
    tenant_patterns = ["global_tenant"]
    allowed_actions = ["write"]
  }
}

```