Upcoming Changes for the OpenSearch Index Authorization Mechanisms
summary
OpenSearch switches from the old all‑or‑nothing index authorization to a safer, request‑level resolution that strips unauthorized indices from index expressions, lands behind a feature flag in 3.7 and becomes default in 4, and already has an implementation merged from several RFCs. It adds use of the IndicesRequestReplaceable and TransportIndicesResolvingAction interfaces, fixes many dashboard bugs, yields a few percent performance gain, and requires reviewing role rules because do_not_fail_on_forbidden is no longer the migration crutch and aliases must be granted directly.
AI-written summary · about
chapters (14)
- 0:00OpenSearch authorization changes
- 3:17Why breaking change is needed
- 7:31Current limits with limited users
- 12:01Problems with do-not-fail flag
- 15:32Goals for new authorization
- 18:03Existing index expression controls
- 20:33New unauthorized index handling
- 26:11Supporting all APIs and plugins
- 29:05Alias privilege changes
- 33:24Breaking changes for aliases
- 34:27Bug fixes and hardening
- 36:11Feedback and migration guide
- 37:15Future security directions
- 38:24Q&A
related talks
30mFuture Paths for the OpenSearch Security Layer
17mFine-Grained Authorization for Secure RAG With OpenSearch
41mSecuring OpenSearch: Hints for avoiding common hassles
26mRule-Based Auto-Tagging in OpenSearch: A Flexible Approach To Multi Tenancy
29mThreat Modeling for OpenSearch: Identifying and Mitigating Security Risks
13mSecuring the Data Frontier: Real-World Strategies With OpenSearch
55mFirewall Reversed: How Open Source Became Asia's Best Defense
11mLightning Talk: A Supply Chain Security View of OpenSearch