2 posts tagged with "access-control"

A Files access key used to say one thing: read, write, or readwrite, optionally under a single prefix. That covers the common case, but real apps want sharper edges. A per-service key that can upload but never delete. An auditor key that can list and read one folder and nothing else. A write-only dropbox confined to inbox/. A locked archive that no key can touch. Today those become one-line policy decisions. Files access keys can now carry a custom inline policy: an ordered list of statements, each with an effect (Allow or Deny), a set of S3 data actions, and object-key prefixes.

OpenSearch's security plugin provides index-level permissions, field-level exclusions, and field masking out of the box. All of these are configurable through the Security REST API, which means you can automate role provisioning in CI/CD pipelines without touching the Dashboards UI. This post documents two concrete access control scenarios tested on a live OpenSearch 2.19.1 cluster managed by FoundryDB, with real HTTP responses showing enforcement in action.

All commands use YOUR_OPENSEARCH_HOST and YOUR_PASSWORD as placeholders. Note that the Security API uses the _plugins/_security prefix.