Managed OpenSearch users and permissions
Every Managed OpenSearch service comes with a user called upadmin. You can add more users in the Control Panel or with the UpCloud API, and give each one only the access it needs. For step-by-step instructions, see How to restrict user access in Managed OpenSearch.
The upadmin user
upadmin is the service's primary user, and its username and password are in the service's connection details. Like any other user, it gets its access from rules once access control is on. Keep it for your own administration and give each application a user of its own.
Access control
Users get their access from rules only while access control is on. You turn it on or off on the service's Users tab in the Control Panel, or with the access_control setting in the API.
A new service starts with access control off. While it's off, every user can read, change and delete every index, whatever its rules.
Once it's on, a user without rules can't use any index, and that includes upadmin. When you turn it on in the Control Panel, Allow unlimited access for existing users adds rules that give every user the service already has full access to every index. Turning access control off again gives every user full access, and the Control Panel doesn't ask you to confirm.
Rules and permissions
Each user has a list of rules, and each rule pairs an index pattern with a permission. In the Control Panel, the rules are on the Access control rules step when you create a user, and in the user's Access control dialog. In the API, they're the rules of opensearch_access_control.
The index pattern is the name of an index, such as products, or a name with *, which stands for any characters. products* covers the products index and every other index whose name starts with products, including indices created later. A pattern without * covers only the index with exactly that name.
The permission decides what the user can do with the indices that the pattern covers:
| Permission | What the user can do |
|---|---|
read | Search the documents and read them by ID, including with _mget and _msearch. |
write | Add, change and delete documents, including with _bulk. Create indices and change their mappings. It can't search or read the documents. |
readwrite | Everything that read and write allow, including deleting documents by query. |
admin | Everything that readwrite allows, and also change index settings and delete indices. |
deny | Nothing. |
The API accepts only these five values, in lowercase.
How rules work together
When several of a user's rules cover the same index, the user gets everything they allow together. A deny rule doesn't take away what another rule gives. To keep a user away from an index, make sure none of its patterns covers that index.
A request that names several indices, or a pattern such as logs-*, is refused unless the user's rules cover every index it names. Requests for every index, such as _cat/indices without an index or _search without an index, need a rule that covers every index, such as *.
Rules cover aliases too. A user can use an alias of an index that its rules cover. A rule that names an alias gives access to the indices behind it, also by their own names.
What every user can see
With access control on, every user can still check the service with requests such as _cluster/health and _cat/health. A user whose rules cover some indices can see the names of every index on the service with GET _aliases, but it can't read the indices that its rules don't cover.
When changes take effect
Changes to a user's rules, and turning access control on or off, apply to the requests sent after the change. Clients don't need to reconnect, and the service keeps running.
When you change a user's password, its rules stay as they are and requests with the old password are refused with 401 Unauthorized. Deleting a user refuses its requests the same way.
Security plugin
The Users tab also has a Security plugin switch, which hands users over to OpenSearch Security. You then manage users and their access in OpenSearch Dashboards, with an administrator user called os-sec-admin. The users and rules the service already has carry over.
The Security plugin can't be turned off. Once it's on, the Control Panel lists only os-sec-admin on the Users tab, and the API no longer creates users or changes their rules.