# Rolemapped backend\_role doesn't have assigned permissions

**URL:** <https://forum.opensearch.org/t/rolemapped-backend-role-doesnt-have-assigned-permissions/6262>\
**Category:** Security\
**Created:** [June 17, 2021, 8:58pm UTC](https://forum.opensearch.org/t/rolemapped-backend-role-doesnt-have-assigned-permissions/6262 "2021-06-17T20:58:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hmw](https://avatars.discourse-cdn.com/v4/letter/h/a87d85/32.png) [@hmw](https://forum.opensearch.org/u/hmw)\
**Post date:** [June 17, 2021, 8:58pm UTC](https://forum.opensearch.org/t/rolemapped-backend-role-doesnt-have-assigned-permissions/6262/1 "2021-06-17T20:58:04Z")

</div>

I’ve got a backend role (iam role from aws), let’s call it `my-role`  
I’ve mapped the predefined role `readall_and_monitor` to backend\_role `my-role`  
Double checking the permissions of `readall_and_monitor` shows that it has the action group `cluster_composite_ops_ro` which includes the allowed action `indices:admin/aliases/get*`. I should note that the actiongroup and role are both predefined and have not been modified.

However, when I make a request to `{my-cluster}/_cat/aliases?format=json&h=alias`  
I get the below error, when the user explicitly does have that permission:

```auto
"type": "security_exception",
"reason": "no permissions for [indices:admin/aliases/get] 
           and User [name=arn:aws:iam::*:role/my-role, 
           backend_roles=[arn:aws:iam::*:role/my-role], 
           requestedTenant=null]"

```

I would assume that `[indices:admin/aliases/get*]` would include `[indices:admin/aliases/get]`

to verify, I got the current settings, and responses were:

```auto
GET .../rolesmapping
"readall_and_monitor": {
   ...
   "backend_roles": [
      "arn:aws:iam::*:role/my-role"
   ]...
}

```

```auto
GET .../roles
"readall_and_monitor": { ...
   "cluster_permissions": [
      "cluster_monitor",
      "cluster_composite_ops_ro"
   ],
   "index_permissions": [{
      "index_patterns": ["*"],
      "fls": [], "masked_fields": [],
      "allowed_actions": ["read", "indices_monitor"]
   }], "tenant_permissions": [], ...
}

```

```auto
GET .../actiongroups
"cluster_composite_ops_ro": {
   ...
   "allowed_actions": [
      "indices:data/read/mget", "indices:data/read/msearch",
      "indices:data/read/mtv", "indices:admin/aliases/exists*",
      "indices:admin/aliases/get*", "indices:data/read/scroll"
   ],
   "type": "cluster",
   "description": "Allow readonly bulk and m* operations",
   "static": false
}

```

from the above 3 requests, it looks like the user should have the required permissions that the error message says it doesn’t have.

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [June 18, 2021, 10:24am UTC](https://forum.opensearch.org/t/rolemapped-backend-role-doesnt-have-assigned-permissions/6262/2 "2021-06-18T10:24:43Z")

</div>

@hmw The permission seems to be on the index level, So in order to rectify this, you can either create a copy of the readall\_and\_monitor and under index permission add indices:admin/aliases/get and only map to this role, as below:

 ![Screenshot 2021-06-18 at 11.22.55](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/3f26be3f122584718b46b80e305c0033b1d7d542.png)

or leave the mapping the way it is and also map to a new role with this one permission.

---

<div class="post-metadata">

**Author:** ![hmw](https://avatars.discourse-cdn.com/v4/letter/h/a87d85/32.png) [@hmw](https://forum.opensearch.org/u/hmw)\
**Post date:** [June 19, 2021, 8:11pm UTC](https://forum.opensearch.org/t/rolemapped-backend-role-doesnt-have-assigned-permissions/6262/3 "2021-06-19T20:11:42Z")

</div>

Thanks, that worked. I was under the mistaken impression that the `indices:admin` indexes were cluster ops, since they are not data indices.

This also indicates that the `cluster_composite_ops_ro` actiongroup and `readall_and_monitor` role are inherently broken, out of the box.