# Permissions for fluent-bit writes

**URL:** <https://forum.opensearch.org/t/permissions-for-fluent-bit-writes/4224>\
**Category:** Security\
**Created:** [November 17, 2020, 10:52am UTC](https://forum.opensearch.org/t/permissions-for-fluent-bit-writes/4224 "2020-11-17T10:52:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![eriklz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/eriklz/32/909_2.png) [@eriklz](https://forum.opensearch.org/u/eriklz)\
**Post date:** [November 17, 2020, 10:52am UTC](https://forum.opensearch.org/t/permissions-for-fluent-bit-writes/4224/1 "2020-11-17T10:52:50Z")

</div>

We have a set-up where we use AWS Elasticsearch service (with ES 7.7, i.e. OpenDistro 1.8) and write log data from fluent-bit running in EKS Kubernetes clusters, using the aws-for-fluent-bit Docker image (v2.8.0)

This works fine - if we set the access controls to full access for the fluent-bit IAM role. However, if we try to restrict permissions to only the operations that fluent-bit perform (essentially bulk writes), it stops working. I have tried various combinations of permissions, but not been successful unless I set full permissions (i.e. \* ), which seems wrong.

Does anyone have a working setup for fluent-bit and using AWS Elasticsearch service, which is not full access?

---

<div class="post-metadata">

**Author:** ![GSmith](https://avatars.discourse-cdn.com/v4/letter/g/bbe5ce/32.png) [@GSmith](https://forum.opensearch.org/u/GSmith)\
**Post date:** [November 17, 2020, 4:05pm UTC](https://forum.opensearch.org/t/permissions-for-fluent-bit-writes/4224/2 "2020-11-17T16:05:28Z")

</div>

@eriklz I am not using AWS Elasticsearch but I have Fluent Bit working with ODFE 1.7.0. In my case, the security setting for my logcollector role are:

```
{
  "index_permissions": [
    {
      "index_patterns": [
        "myindexes_*"
      ],
      "fls": [],
      "masked_fields": [],
      "allowed_actions": [
        "crud",
        "create_index"
      ]
    }
  ],
  "tenant_permissions": [],
  "cluster_permissions": []
}

```

I don’t know if that helps at all; things may be different with AWS Elasticsearch.

---

<div class="post-metadata">

**Author:** ![eriklz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/eriklz/32/909_2.png) [@eriklz](https://forum.opensearch.org/u/eriklz)\
**Post date:** [November 23, 2020, 4:47pm UTC](https://forum.opensearch.org/t/permissions-for-fluent-bit-writes/4224/3 "2020-11-23T16:47:18Z")

</div>

That is one combination I have tried and that did not work, even setting “index:_" and "cluster:_” does not help. Only thing that worked was to map the AWS IAM role as backend\_role to the pre-defined “all\_access” role.  
For my custom role settings I did create a separate log\_writer role and had a mapping which associated the backend\_role with that role.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [August 16, 2021, 12:15am UTC](https://forum.opensearch.org/t/permissions-for-fluent-bit-writes/4224/4 "2021-08-16T00:15:35Z")

</div>

@eriklz

Did you find the solution to your issue? Are you still running ODFE 1.8?

---

<div class="post-metadata">

**Author:** ![eriklz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/eriklz/32/909_2.png) [@eriklz](https://forum.opensearch.org/u/eriklz)\
**Post date:** [August 16, 2021, 6:54am UTC](https://forum.opensearch.org/t/permissions-for-fluent-bit-writes/4224/5 "2021-08-16T06:54:13Z")

</div>

@pablo No, not while I was working on that project. I am not working on that project anymore though since December, so not sure what the current status is.

---

<div class="post-metadata">

**Author:** ![q2dg](https://avatars.discourse-cdn.com/v4/letter/q/dec6dc/32.png) [@q2dg](https://forum.opensearch.org/u/q2dg)\
**Post date:** [January 2, 2022, 9:00pm UTC](https://forum.opensearch.org/t/permissions-for-fluent-bit-writes/4224/6 "2022-01-02T21:00:10Z")

</div>

Hello.  
I don’t know if it’s offtopic…if it is I apologize.

I’m having problems trying to send data from Fluent-bit to a self-hosted OpenSearch server.  
Basically I’m running an docker container from the official image which is a single-node cluster with default credentials and demo snake-oil TLS certificate but a command like `fluent-bit -v -i cpu -t cpu -o es -p Host=192.168.1.145 -p Port=9200 -p Index=unIndex -p HTTP_User=admin -p HTTP_Passwd=admin -p Tls=on -p Tls.verify=off -m "*"` doesn’t send anything.

I’ve even tried to removing security plugin and trying to connect through plain HTTP to see if it was a problem about encryption/authentication but it’s the same: transfer between Fluent-bit and OpenSearch doesn’t occur

I’ve open this issue in Fluent-bit github ([Add compatibility for self-hosted OpenSearch servers in "es" output plugin, please! · Issue #4550 · fluent/fluent-bit · GitHub](https://github.com/fluent/fluent-bit/issues/4550)) but for completeness Iḿ writting this problem here, because I’n really stuck.

Thanks a lot