Skip to content

AWS Opensearch authentication failure #624

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
symmetriac opened this issue Sep 12, 2022 · 2 comments
Closed

AWS Opensearch authentication failure #624

symmetriac opened this issue Sep 12, 2022 · 2 comments

Comments

@symmetriac
Copy link

symmetriac commented Sep 12, 2022

We have AWS Opensearch cluster 1.3 and elasticsearch exporter running in EKS cluster with irsa role.
In Opensearch we have role with needed permissions and mapping for the irsa role.
Elasticsearch exporter running with --aws-region option so it uses the AWS_WEB_IDENTITY_TOKEN_FILE for authentication.

It's all works well and we see a metrics in grafana and no errors in exporter logs, but after 1 hour it starts to show 403 error code in logs.
In Opensearch audit logs for the exporter requests we can see that it doesn't use irsa role arn anymore:

"audit_request_effective_user": "<NONE>"

After exporter pod restarting errors are gone and metrics available again, but the issue reoccurs after 1 hour.

@symmetriac
Copy link
Author

UPD: If I run exporter on ec2 with IAM role attached, it works as expected.

@sysadmind
Copy link
Contributor

@symmetriac Is your problem resolved? I'm not sure I understand the original problem, but your last comment makes it sound like the problem has been resolved. If not, please re-open with some more context if possible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants