Unable to restore snapshot with cluster state included

Security
1

Versions

OpenSearch 2.6 and OpenSearch Dashboards

Describe the issue:
I’m getting the below error when I try to restore a snapshot that includes cluster state.
I am able to restore snapshots that don’t include the cluster state. I have tested using the default admin user as well and also assigned the required backend roles to the user.

Failed to restore snapshot testindex
no permissions for [] and User [name=amith, backend_roles=[manage_snapshots, snapshotrestore, admin, all_access], requestedTenant=].

Index Management - SnapshotManagementService - restoreSnapshot: StatusCodeError: [security_exception] no permissions for [] and User [name=amith, backend_roles=[manage_snapshots, snapshotrestore, admin, all_access], requestedTenant=]
    at respond (/opt/opensearch-dashboards-2.6.0/node_modules/elasticsearch/src/lib/transport.js:349:15)
    at checkRespForFailure (/opt/opensearch-dashboards-2.6.0/node_modules/elasticsearch/src/lib/transport.js:306:7)
    at HttpConnector.<anonymous> (/opt/opensearch-dashboards-2.6.0/node_modules/elasticsearch/src/lib/connectors/http.js:173:7)
    at IncomingMessage.wrapper (/opt/opensearch-dashboards-2.6.0/node_modules/lodash/lodash.js:4991:19)
    at IncomingMessage.emit (events.js:412:35)
    at IncomingMessage.emit (domain.js:475:12)
    at endReadableNT (internal/streams/readable.js:1333:12)
    at processTicksAndRejections (internal/process/task_queues.js:82:21) {
  status: 403,
  displayName: 'AuthorizationException',
  path: '/_snapshot/my-fs-repository/testindex/_restore',
  query: {},
  body: {
    error: {
      root_cause: [Array],
      type: 'security_exception',
      reason: 'no permissions for [] and User [name=amith, backend_roles=[manage_snapshots, snapshotrestore, admin, all_access], requestedTenant=]'
    },
    status: 403
  },
  statusCode: 403,
  response: '{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=amith, backend_roles=[manage_snapshots, snapshotrestore, admin, all_access], requestedTenant=]"}],"type":"security_exception","reason":"no permissions for [] and User [name=amith, backend_roles=[manage_snapshots, snapshotrestore, admin, all_access], requestedTenant=]"},"status":403}',
  toString: [Function (anonymous)],
  toJSON: [Function (anonymous)]

Any help is appreciated.

Regards,
Amith

2

@Amith To restore a snapshot with the global state you must use admin certificates defined in the plugins.security.authcz.admin_dn in opensearch.yml.

3

Thanks, that worked

Regards,
Amith