# No permissions for Snapshot

**URL:** <https://forum.opensearch.org/t/no-permissions-for-snapshot/14772>\
**Category:** OpenSearch\
**Created:** [June 21, 2023, 9:52am UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772 "2023-06-21T09:52:12Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![shivag](https://avatars.discourse-cdn.com/v4/letter/s/97f17d/32.png) [@shivag](https://forum.opensearch.org/u/shivag)\
**Post date:** [June 21, 2023, 9:52am UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/1 "2023-06-21T09:52:12Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

**Describe the issue** : After taking the snapshot of indices and when we tried to restore the snapshot of indices, im getting error as below

**{**  
**“error” : {**  
**“root\_cause” : [**  
**{**  
**“type” : “security\_exception”,**  
**“reason” : “no permissions for [] and User [name=admin, backend\_roles=[admin], requestedTenant=null]”**  
**}**  
**],**  
**“type” : “security\_exception”,**  
**“reason” : “no permissions for [] and User [name=admin, backend\_roles=[admin], requestedTenant=null]”**  
**},**  
**“status” : 403**  
**}**

**Configuration** : **POST /\_snapshot/my-fs-repository/wazuh\_snapshot/\_restore**

**Relevant Logs or Screenshots** :

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/6/6a487cf23b45238ed002b61ba37409cdfd55cde2.png)

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [June 21, 2023, 2:26pm UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/2 "2023-06-21T14:26:25Z")

</div>

@shivag If you took the snapshot with the global state than you must use admin certificate to restore the snapshot as the snapshot will also contain security plugin index.

> **[Take and restore snapshots](https://opensearch.org/docs/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/#security-considerations)**
>
> Take and restore snapshots

---

<div class="post-metadata">

**Author:** ![Iqra\_shafiq](https://avatars.discourse-cdn.com/v4/letter/i/d2c977/32.png) [@Iqra\_shafiq](https://forum.opensearch.org/u/Iqra_shafiq)\
**Post date:** [June 10, 2024, 6:50am UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/3 "2024-06-10T06:50:08Z")

</div>

I have not included the global state. still I am facing the issue.

Command used for taking snapshot:

```auto
curl -XPUT -k -u admin:opensearch123 "https://192.168.0.28:9200/_snapshot/snapshot_repository/latest_snapshot" -H "Content-Type: application/json" -d '
{
  "ignore_unavailable": true,
  "include_global_state": false,
  "partial": false
}
'

```

Command for restoring snapshot in same cluster:

```auto
curl -XPOST -k -u admin:opensearch123 "https://192.168.0.28:9200/_snapshot/snapshot_repository/latest_snapshot/_restore" -H "Content-Type: application/json" -d '
{
  "ignore_unavailable": true,
  "include_global_state": false,
  "include_aliases": false,
  "partial": false
}
'

```

Below is the error I am facing:

```auto
{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=admin, backend_roles=[admin], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=admin, backend_roles=[admin], requestedTenant=null]"},

```

---

<div class="post-metadata">

**Author:** ![Iqra\_shafiq](https://avatars.discourse-cdn.com/v4/letter/i/d2c977/32.png) [@Iqra\_shafiq](https://forum.opensearch.org/u/Iqra_shafiq)\
**Post date:** [June 10, 2024, 7:04am UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/4 "2024-06-10T07:04:06Z")

</div>

I have also tried following command but still error remains same:

```auto
curl -XPOST -k -u admin:opensearch123 "https://192.168.0.28:9200/_snapshot/snapshot_repository/latest_snapshot/_restore" -H "Content-Type: application/json" -d '
{
  "ignore_unavailable": true,
  "indices": "-.opendistro_security",
  "include_global_state": false,
  "include_aliases": false,
  "partial": false,
  "rename_pattern": "(security-auditlog-2024.05.30)",
  "rename_replacement": "security-auditlog-2024.05.30_restored"
}
'

```

```auto
 curl -XPOST -k -u admin:opensearch123 "https://192.168.0.28:9200/_snapshot/snapshot_repository/latest_snapshot/_restore" -H "Content-Type: application/json" --key "/opt/opensearch/config/certs/node1-key.pem" --cert "/opt/opensearch/config/certs/node1.pem" --cacert "/opt/opensearch/config/certs/root-ca.pem" -d '
{
  "ignore_unavailable": true,
  "indices": "-.opendistro_security",
  "include_global_state": false,
  "include_aliases": false,
  "partial": false,
  "rename_pattern": "(security-auditlog-2024.05.30)",
  "rename_replacement": "security-auditlog-2024.05.30_restored"
}
'

```

Facing below error:

```auto
{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=admin, backend_roles=[admin], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=admin, backend_roles=[admin], requestedTenant=null]"},"status":403}

```

---

<div class="post-metadata">

**Author:** ![Yuv](https://avatars.discourse-cdn.com/v4/letter/y/8797f3/32.png) [@Yuv](https://forum.opensearch.org/u/Yuv)\
**Post date:** [January 23, 2025, 12:10pm UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/5 "2025-01-23T12:10:52Z")

</div>

Hey there, I am also facing the issue. I have not included global state, I have given all necessary permissions aswell. Please help me resolve this issue as soon as possible.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [January 23, 2025, 1:39pm UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/6 "2025-01-23T13:39:55Z")

</div>

@Yuv Could you share your OpenSearch version?

---

<div class="post-metadata">

**Author:** ![Yuv](https://avatars.discourse-cdn.com/v4/letter/y/8797f3/32.png) [@Yuv](https://forum.opensearch.org/u/Yuv)\
**Post date:** [January 24, 2025, 10:22am UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/7 "2025-01-24T10:22:00Z")

</div>

I am using 2.18.0.

---

<div class="post-metadata">

**Author:** ![Yuv](https://avatars.discourse-cdn.com/v4/letter/y/8797f3/32.png) [@Yuv](https://forum.opensearch.org/u/Yuv)\
**Post date:** [January 24, 2025, 10:25am UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/8 "2025-01-24T10:25:52Z")

</div>

So I just happen to come across a new error, apparently I am able to restore individual index, but not all indices.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [January 24, 2025, 12:42pm UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/9 "2025-01-24T12:42:11Z")

</div>

@Yuv What exactly are your backup and restore commands?

---

<div class="post-metadata">

**Author:** ![Yuv](https://avatars.discourse-cdn.com/v4/letter/y/8797f3/32.png) [@Yuv](https://forum.opensearch.org/u/Yuv)\
**Post date:** [January 24, 2025, 2:38pm UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/10 "2025-01-24T14:38:08Z")

</div>

Backup CMD -

```auto
curl -sk -u "admin:dev@Pa&&w0rd" -X PUT "https://localhost:9200/_snapshot/my_backup_repo/all_indices_snapshot?wait_for_completion=true" -H 'Content-Type: application/json' -d'
{
  "indices": "_all",
  "include_global_state": false
}'

```

Successful, I can see the snapshot in my Snapshot Repo

Backup CMD -

```auto
curl -sk -u "admin:dev@Pa&&w0rd" -X POST "https://localhost:9200/_snapshot/my_backup_repo/all_indices_snapshot/_restore?wait_for_completion=true" -H 'Content-Type: application/json' -d'
{
  "indices": "_all",
  "include_global_state": false
}'

```

Output -

```auto
{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=admin, backend_roles=[admin], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=admin, backend_roles=[admin], requestedTenant=null]"},"status":403}

```

---

<div class="post-metadata">

**Author:** ![Yuv](https://avatars.discourse-cdn.com/v4/letter/y/8797f3/32.png) [@Yuv](https://forum.opensearch.org/u/Yuv)\
**Post date:** [January 27, 2025, 7:29am UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/11 "2025-01-27T07:29:10Z")

</div>

Hey? Is there anything wrong with my cmds?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [January 27, 2025, 1:07pm UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/12 "2025-01-27T13:07:19Z")

</div>

@Yuv Both commands are fine if the backup doesn’t contain the .opendistro\_security index.  
As per documentation, you must use admin certs to restore snapshots containing the mentioned index or use a regular user with required permissions and exclude.opendistro\_security index from the restore.

> **[Take and restore snapshots](https://opensearch.org/docs/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/#security-considerations)**
>
> Take and restore snapshots

This is my working example.

```auto
curl -sk -u "pablo:VMware123!" -X POST "https://localhost:9200/_snapshot/my-repo/all_indices_snapshot1/_restore?wait_for_completion=true" -H 'Content-Type: application/json' -d'
{
  "indices": "-.opendistro_security",
  "include_global_state": false,
  "rename_replacement": "restored_index_$1",
  "rename_pattern": "(.+)"
}'

```

```auto
[opensearch@01ed6c801955 ~]$ curl --insecure -u pablo:Eliatra123! https://localhost:9200/_plugins/_security/authinfo?pretty {
  "user" : "User [name=pablo, backend_roles=[, snapshotrestore], requestedTenant=null]",
  "user_name" : "pablo",
  "user_requested_tenant" : null,
  "remote_address" : "[::1]:43104",
  "backend_roles" : [
    "",
    "snapshotrestore"
  ],
  "custom_attribute_names" : [],
  "roles" : [
    "manage_snapshots",
    "own_index"
  ],
  "tenants" : {
    "pablo" : true
  },
  "principal" : null,
  "peer_certificates" : "0",
  "sso_logout_url" : null
}

```

---

<div class="post-metadata">

**Author:** ![Yuv](https://avatars.discourse-cdn.com/v4/letter/y/8797f3/32.png) [@Yuv](https://forum.opensearch.org/u/Yuv)\
**Post date:** [January 28, 2025, 10:07am UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/13 "2025-01-28T10:07:49Z")

</div>

Got it! Thanks

---

<div class="post-metadata">

**Author:** ![nateynate](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/nateynate/32/4913_2.png) [@nateynate](https://forum.opensearch.org/u/nateynate)\
**Post date:** [January 30, 2025, 8:24pm UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/14 "2025-01-30T20:24:12Z")

</div>

Let us know if you managed to get it working @Yuv !

---

<div class="post-metadata">

**Author:** ![Yuv](https://avatars.discourse-cdn.com/v4/letter/y/8797f3/32.png) [@Yuv](https://forum.opensearch.org/u/Yuv)\
**Post date:** [January 31, 2025, 9:40am UTC](https://forum.opensearch.org/t/no-permissions-for-snapshot/14772/15 "2025-01-31T09:40:39Z")

</div>

Yes Got it Thanks ✌