hashicorp / hashicorp/vault-plugin-database-elasticsearch
Connection test fails with AWS OpenSearch/Elasticsearch
- Dominant language
- Go
- Stars
- 31
- Forks
- 8
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 2
Description
I'm trying to create a database connection to an AWS OpenSearch/Elasticsearch cluster.
I get the following error whether I use `elasticsearch_version = "7.10"` or `elasticsearch_version = "OpenSearch_1.1"` in the `aws_elasticsearch_domain` resource:
```
vault_database_secret_backend_connection.es: Creating...
╷
│ Error: error configuring database connection "elasticsearch/config/staging": Error making API request.
│
│ URL: PUT https:///v1/elasticsearch/config/staging
│ Code: 400. Errors:
│
│ * error creating database object: client test of getting a role failed: 401: {"Message":"Your request: '/_xpack/security/role/vault-test' is not allowed."}
│
│ with vault_database_secret_backend_connection.es,
│ on vault.tf line 23, in resource "vault_database_secret_backend_connection" "es":
│ 23: resource "vault_database_secret_backend_connection" "es" {
```
I'm able to make calls to ES using the same credentials from my command line, but when I request that specific path, it gives me the same error.
The `internal_user_database_enabled` setting on the ES cluster is set to `true`.
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the connection described in vault.tf using AWS OpenSearch/Elasticsearch and the reported elasticsearch_version values. Start by tracing the connection test request for /_xpack/security/role/vault-test and compare it with the successful command-line calls; done when the cause and required compatibility change are established.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, elasticsearch, go
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100