(aws-opensearchservice): grant_read does not grant all read operations permissons
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### What is the problem?
[aws-opensearchservice.Domain#grantRead](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-opensearchservice.Domain.html#grantwbrreadidentity) grants permissions to use the [GET and HEAD](https://github.com/aws/aws-cdk/blob/e6c4ca5e71934e890eabe41190e9c2d0bd42aefb/packages/%40aws-cdk/aws-opensearchservice/lib/perms.ts#L1-L4) HTTP verbs.
However as per https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html [*], the search operations supports invocation via both GET and POST verbs. Further more [the Opensearch Python client uses POST for search](https://github.com/opensearch-project/opensearch-py/blob/ef0c23c0e4fb089e147d868a9ebb1e0feae2b770/opensearchpy/client/__init__.py#L1593-L1599) [**].
The end result being that grantRead does not actually provide the required permissions for basic read operations.
[*] [I could not find the Opensearch version of this API reference page](https://github.com/opensearch-project/documentation-website/issues/299).
[**] I've assigned [a bug to the Opensearch-py library for this](https://github.com/opensearch-project/opensearch-py/issues/95)
### Reproduction Steps
Too much code required to create a working repro here.
### What did you expect to happen?
I would expect that `grantRead` would grant me permissions for all read operations. Failing that, I'd expect the documentation of the grant operations to talk about the limitations caused by the usage of HTTP verbs for IAM permissions purposes combined with Elasticsearch allowing usage of POST for read operations.
### What actually happened?
`grantRead` does not grant permission for all read operations.
### CDK CLI Version
1.134.0
### Framework Version
_No response_
### Node.js Version
14.17.0
### OS
Windows 10 Professional: 10.0.19043 Build 19043
### Language
Typescript, Python, .NET, Java, Go
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start in packages/@aws-cdk/aws-opensearchservice/lib/perms.ts, where grantRead’s HTTP verbs are defined, and trace the related grant methods and tests if present. Verify the permissions against the documented GET/POST search behavior, then determine whether the expected result is expanded read permissions or documentation of the limitation. Done means the chosen behavior is implemented and covered appropriately.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- authorization, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100