Denied AWS Opensearch write permission

Question

I'm trying to connect a spring boot application from AWS EKS to AWS Opensearch both of which reside in a VPC. Though the connection is successful im unable to write any data to the index.

All the AWS resources - EKS and Opensearch are configured using terraform. I have mentioned the elasticsearch subnet CIDR in the egress which is attached to the application. Also, the application correctly assumes the EKS service account and the pod role - which I mentioned in the services stanza for Elasticsearch. In the policy which is attached to the pod role, I see all the permissions mentioned - ESHttpPost, ESHttpget, ESHttpPut, etc.

This is the error I get,

{"error":{"root_cause": [{"type":"security_exception", "reason":"no 
permissions for [indices:data/write/index] and User 
[name=arn:aws:iam::ACCOUNT_NO:role/helloworld-demo-eks-PodRle- 
hellodemo-role-1,backend_roles= 
[arn:aws:iam::ACCOUNT_NO:role/helloworld-demo-eks-PodRle-hellodemo 
role-1], requested 
Tenant=null]"}],"type":"security_exception", "reason":"no 
permissions for [indices:data/write/index] and User 
[name=arn:aws:iam::ACCOUNT_NO:role/helloworld demo-eks-PodRle- 
hellodemo-role-1,
backend_roles=[arn:aws:iam::ACCOUNT_NO:role/helloworld-demo-eks- 
PodRle-hellodemo role-1], requested Tenant=null]"},"status":403}

Is there anything that I'm missing out on while configuring?

Answer 1

This error can be resolved by assigning the pod role to additional_roles key in the Elasticsearch terraform. This internally is taken care by AWS STS when it receives a request from EKS.