aws / aws/aws-cdk

(aws-opensearchservice): grant_read does not grant all read operations permissons

Open
#17,761 2 comments 3 reactions 0 assignees View on GitHub
@aws-cdk/aws-opensearch bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### What is the problem?

[aws-opensearchservice.Domain#grantRead](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-opensearchservice.Domain.html#grantwbrreadidentity) grants permissions to use the [GET and HEAD](https://github.com/aws/aws-cdk/blob/e6c4ca5e71934e890eabe41190e9c2d0bd42aefb/packages/%40aws-cdk/aws-opensearchservice/lib/perms.ts#L1-L4) HTTP verbs.

However as per https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html [*], the search operations supports invocation via both GET and POST verbs. Further more [the Opensearch Python client uses POST for search](https://github.com/opensearch-project/opensearch-py/blob/ef0c23c0e4fb089e147d868a9ebb1e0feae2b770/opensearchpy/client/__init__.py#L1593-L1599) [**].

The end result being that grantRead does not actually provide the required permissions for basic read operations.

[*] [I could not find the Opensearch version of this API reference page](https://github.com/opensearch-project/documentation-website/issues/299).
[**] I've assigned [a bug to the Opensearch-py library for this](https://github.com/opensearch-project/opensearch-py/issues/95)

### Reproduction Steps

Too much code required to create a working repro here.

### What did you expect to happen?

I would expect that `grantRead` would grant me permissions for all read operations. Failing that, I'd expect the documentation of the grant operations to talk about the limitations caused by the usage of HTTP verbs for IAM permissions purposes combined with Elasticsearch allowing usage of POST for read operations.

### What actually happened?

`grantRead` does not grant permission for all read operations.

### CDK CLI Version

1.134.0

### Framework Version

_No response_

### Node.js Version

14.17.0

### OS

Windows 10 Professional: 10.0.19043 Build 19043

### Language

Typescript, Python, .NET, Java, Go

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in packages/@aws-cdk/aws-opensearchservice/lib/perms.ts, where grantRead’s HTTP verbs are defined, and trace the related grant methods and tests if present. Verify the permissions against the documented GET/POST search behavior, then determine whether the expected result is expanded read permissions or documentation of the limitation. Done means the chosen behavior is implemented and covered appropriately.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authorization, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.