# Permissions not allowing report download or report definition creation **URL:** \ **Category:** Reporting Plugin\ **Tags:** troubleshoot\ **Created:** [June 19, 2025, 8:27am UTC](https://forum.opensearch.org/t/permissions-not-allowing-report-download-or-report-definition-creation/24831 "2025-06-19T08:27:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![matthew1](https://avatars.discourse-cdn.com/v4/letter/m/ed655f/32.png) [@matthew1](https://forum.opensearch.org/u/matthew1)\ **Post date:** [June 19, 2025, 8:27am UTC](https://forum.opensearch.org/t/permissions-not-allowing-report-download-or-report-definition-creation/24831/1 "2025-06-19T08:27:17Z")
Hi I’m attempting to create a role that, among other things, enables use of the Reporting plugin. The challenge is that I’m getting _“Insufficient permissions. Reach out to your OpenSearch Dashboards administrator.”_ when trying to generate/download a report, or create a report definition. I’m using AWS Opensearch v 2.19 - Dashboards 2.19.2 The custom role my user has can be seen below. This is the only role they have. Any help will be greatly appreciated. ```auto { "TestRole": { "reserved": false, "hidden": false, "cluster_permissions": [ "cluster_composite_ops", "cluster:admin/opendistro/reports/definition/create", "cluster:admin/opendistro/reports/definition/update", "cluster:admin/opendistro/reports/definition/delete", "cluster:admin/opendistro/reports/definition/get", "cluster:admin/opendistro/reports/definition/list", "cluster:admin/opendistro/reports/definition/on_demand", "cluster:admin/opendistro/reports/instance/get", "cluster:admin/opendistro/reports/instance/list", "cluster:admin/opendistro/reports/menu/download" ], "index_permissions": [ { "index_patterns": [ "xapi.data" ], "dls": "", "fls": [], "masked_fields": [], "allowed_actions": [ "read", "write", "indices:admin/create" ] }, { "index_patterns": [ ".opendistro-reports-*", ".opendistro-reports-definitions", ".opendistro-reports-instances" ], "dls": "", "fls": [], "masked_fields": [], "allowed_actions": [ "indices:data/write/index", "indices:admin/create", "indices:data/read/search" ] }, { "index_patterns": [ ".kibana_*", ".opensearch_dashboards" ], "dls": "", "fls": [], "masked_fields": [], "allowed_actions": [ "read", "write", "indices:admin/create" ] } ], "tenant_permissions": [ { "tenant_patterns": [ "global_tenant" ], "allowed_actions": [ "kibana_all_write" ] } ], "static": false } } ``` ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [June 19, 2025, 8:55am UTC](https://forum.opensearch.org/t/permissions-not-allowing-report-download-or-report-definition-creation/24831/2 "2025-06-19T08:55:59Z")
@matthew1 I have tested this config in a stand alone OpenSearch and user is able to generate reports and create policies. Are you getting any messages in the Error and audit logs? ---
**Author:** ![matthew1](https://avatars.discourse-cdn.com/v4/letter/m/ed655f/32.png) [@matthew1](https://forum.opensearch.org/u/matthew1)\ **Post date:** [June 19, 2025, 2:17pm UTC](https://forum.opensearch.org/t/permissions-not-allowing-report-download-or-report-definition-creation/24831/3 "2025-06-19T14:17:35Z")
Hi @Anthony - we’re seeing the following in error logs. ```auto status: 403, displayName: 'AuthorizationException', path: '/_plugins/_query/_datasources', query: {}, body: '{\n' + ' "status": 403,\n' + ' "error": {\n' + ' "type": "OpenSearchSecurityException",\n' + ' "reason": "There was internal problem at backend",\n' + ' "details": "no permissions for [cluster:admin/opensearch/ql/datasources/read] and User [name\\u003dTestRole, backend_roles\\u003d[TestRole], requestedTenant\\u003d]"\n' + ' }\n' + '}', statusCode: 403, response: '{\n' + ' "status": 403,\n' + ' "error": {\n' + ' "type": "OpenSearchSecurityException",\n' + ' "reason": "There was internal problem at backend",\n' + ' "details": "no permissions for [cluster:admin/opensearch/ql/datasources/read] and User [name\\u003dTestRole, backend_roles\\u003d[TestRole], requestedTenant\\u003d]"\n' + ' }\n' + '}', toString: [Function (anonymous)], toJSON: [Function (anonymous)] } ``` ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [June 19, 2025, 2:24pm UTC](https://forum.opensearch.org/t/permissions-not-allowing-report-download-or-report-definition-creation/24831/4 "2025-06-19T14:24:04Z")
Have you tried adding this permission? ---
**Author:** ![matthew1](https://avatars.discourse-cdn.com/v4/letter/m/ed655f/32.png) [@matthew1](https://forum.opensearch.org/u/matthew1)\ **Post date:** [June 19, 2025, 2:56pm UTC](https://forum.opensearch.org/t/permissions-not-allowing-report-download-or-report-definition-creation/24831/5 "2025-06-19T14:56:25Z")
Yes. I got the same on-screen error message. Upon checking the logs, the error was then different: “Permission denied for ObservabilityObject creation”. Having Googled this, I’ve added 4 cluster permissions: - cluster/admin/opensearch/observability/get - cluster/admin/opensearch/observability/create - cluster/admin/opensearch/observability/update - cluster/admin/opensearch/observability/delete Having tested again, I get the same error message: “Permission denied for ObservabilityObject creation”. ---
**Author:** ![matthew1](https://avatars.discourse-cdn.com/v4/letter/m/ed655f/32.png) [@matthew1](https://forum.opensearch.org/u/matthew1)\ **Post date:** [June 24, 2025, 8:30am UTC](https://forum.opensearch.org/t/permissions-not-allowing-report-download-or-report-definition-creation/24831/6 "2025-06-24T08:30:42Z")
We’ve dug into this a bit further and are currently thinking our issue may be related to this bug: [GitHub · Where software is built](https://github.com/opensearch-project/reporting/issues/1099)