OpenSearch Serverless控制台访问提示未授权错误求助

1. 检查数据访问策略配置 #

即使网络设为公开，数据访问策略未授权Dashboards访问权限的话，仍会触发权限错误。需确保策略包含aoss:DashboardsAccess及必要的索引操作权限：

resource "aws_opensearchserverless_access_policy" "dashboard_data_access" {
  name        = "dashboard-data-access"
  type        = "data"
  description = "Grant access to OpenSearch Dashboards and index operations"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = "*" # 公开访问场景使用*，生产环境建议限定特定ARN
        }
        Action = [
          "aoss:DashboardsAccess",
          "aoss:ReadDocument",
          "aoss:WriteDocument"
        ]
        Resource = [
          "arn:aws:aoss:${var.region}:${var.account_id}:collection/${aws_opensearchserverless_collection.main.name}",
          "arn:aws:aoss:${var.region}:${var.account_id}:index/${aws_opensearchserverless_collection.main.name}/*"
        ]
      }
    ]
  })
}

2. 验证网络访问策略规则 #

公开访问场景下，需确认网络策略允许公网来源访问Dashboards端口，且包含aoss:DashboardsAccess动作：

resource "aws_opensearchserverless_security_policy" "public_network_access" {
  name        = "public-network-policy"
  type        = "network"
  description = "Allow public access to collection and Dashboards"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = "*"
        Action = [
          "aoss:DashboardsAccess",
          "aoss:ReadDocument",
          "aoss:WriteDocument"
        ]
        Resource = [
          "arn:aws:aoss:${var.region}:${var.account_id}:collection/${aws_opensearchserverless_collection.main.name}"
        ]
        Condition = {
          IpAddress = {
            "aws:SourceIp" = ["0.0.0.0/0"]
          }
        }
      }
    ]
  })
}

3. 确认集合Dashboards启用状态 #

检查Terraform配置中是否明确启用Dashboards，避免默认配置异常：

resource "aws_opensearchserverless_collection" "main" {
  name        = "my-serverless-collection"
  type        = "SEARCH"
  dashboard_options {
    enabled = true # 明确启用Dashboards
  }
}

注：集合创建后，Dashboards可能需要1-2分钟完成初始化，等待后重试访问。

4. 排查IAM权限（若通过AWS账号访问） #

如果是登录AWS控制台后点击Dashboards链接，需确保当前IAM用户/角色拥有aoss:DashboardsAccess权限：

{
  "Effect": "Allow",
  "Action": "aoss:DashboardsAccess",
  "Resource": "arn:aws:aoss:REGION:ACCOUNT_ID:collection/COLLECTION_NAME"
}

5. 验证策略关联状态 #

检查数据访问策略、网络策略是否已正确关联到目标集合。可通过AWS控制台进入集合详情页，确认"数据访问策略"和"网络访问策略"列表中包含你配置的策略。

内容的提问来源于stack exchange，提问作者Gunjit Sidher