Opensearch Dashboards cannot connect to AWS OpenSearch

Security
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

public.ecr.aws/opensearchproject/opensearch-dashboards:2.11.1

Describe the issue:

Hi,

I’m trying to connect OpenSearch Dashboards to OpenSearch Service within AWS, but I have some issues into connection.
I use 2.11 on AWS and 2.11.1 as Docker image itself within K8S.

Could you please suggest/help on this topic?
Regards

Configuration:

    server.host: "0.0.0.0"

    opensearch.ssl.verificationMode: none # if not using HTTPS
    
    opensearch_security.auth.type: basicauth
    opensearch_security.auth.anonymous_auth_enabled: false
    opensearch_security.cookie.secure: false # set to true when using HTTPS
    opensearch_security.cookie.ttl: 3600000
    opensearch_security.session.ttl: 3600000
    opensearch_security.session.keepalive: false
    opensearch_security.multitenancy.enabled: false
    opensearch_security.readonly_mode.roles: ['opensearch_dashboards_read_only']
    opensearch_security.auth.unauthenticated_routes: []
    opensearch_security.basicauth.login.title: 'Please log in using your username and password'

    opensearch.requestHeadersWhitelist: [authorization, securitytenant, security_tenant]

And ENV variables for host/username/password:

          env:
            - name: OPENSEARCH_USERNAME
              value: "osearch"  
            - name: OPENSEARCH_HOSTS
              value: "https://DOMAIN.eu-central-1.es.amazonaws.com"
            - name: OPENSEARCH_PASSWORD
              value: "PASS"

Relevant Logs or Screenshots:

{"type":"log","@timestamp":"2024-03-11T09:15:45Z","tags":["info","plugins-service"],"pid":1,"message":"Plugin \"visTypeXy\" is disabled."}
{"type":"log","@timestamp":"2024-03-11T09:15:45Z","tags":["warning","config","deprecation"],"pid":1,"message":"\"cpu.cgroup.path.override\" is deprecated and has been replaced by \"ops.cGroupOverrides.cpuPath\""}
{"type":"log","@timestamp":"2024-03-11T09:15:45Z","tags":["warning","config","deprecation"],"pid":1,"message":"\"cpuacct.cgroup.path.override\" is deprecated and has been replaced by \"ops.cGroupOverrides.cpuAcctPath\""}
{"type":"log","@timestamp":"2024-03-11T09:15:45Z","tags":["info","plugins-system"],"pid":1,"message":"Setting up [44] plugins: [alertingDashboards,usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,embeddable,legacyExport,expressions,data,home,apmOss,console,management,indexPatternManagement,advancedSettings,savedObjects,securityDashboards,reportsDashboards,indexManagementDashboards,anomalyDetectionDashboards,dashboard,visualizations,visTypeVega,visTypeTimeline,timeline,visTypeTable,visTypeMarkdown,tileMap,regionMap,inputControlVis,ganttChartDashboards,visualize,queryWorkbenchDashboards,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,observabilityDashboards,discover,savedObjectsManagement,bfetch]"}
{"type":"log","@timestamp":"2024-03-11T09:15:46Z","tags":["info","savedobjects-service"],"pid":1,"message":"Waiting until all OpenSearch nodes are compatible with OpenSearch Dashboards before starting saved objects migrations..."}
{"type":"log","@timestamp":"2024-03-11T09:15:46Z","tags":["error","opensearch","data"],"pid":1,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2024-03-11T09:15:46Z","tags":["error","savedobjects-service"],"pid":1,"message":"Unable to retrieve version information from OpenSearch nodes."}
{"type":"log","@timestamp":"2024-03-11T09:15:49Z","tags":["error","opensearch","data"],"pid":1,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2024-03-11T09:15:51Z","tags":["error","opensearch","data"],"pid":1,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2024-03-11T09:15:54Z","tags":["error","opensearch","data"],"pid":1,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2024-03-11T09:15:56Z","tags":["error","opensearch","data"],"pid":1,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2024-03-11T09:15:59Z","tags":["error","opensearch","data"],"pid":1,"message":"[ResponseError]: Response Error"}
2

@eugeniu Have you tried using ‘kibanaserver’ as OpenSearch user and password?
Please share your config.yml file.

3

Hi @pablo,

This is my config for opensearch-dashboard:

opensearch.hosts: [“https://DOMAIN.eu-central-1.es.amazonaws.com”]
opensearch.username: ‘username’
opensearch.password: ‘password’

Based on docs provided by AWS:

For OpenSearch itself, I don’t have a self-managed config as it’s hosted on AWS

4

@eugeniu Could you try running the below command?

curl --insecure -u <username>:<password> -XGET https://DOMAIN.eu-central-1.es.amazonaws.com