> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fastfoundation.nimble.la/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenSearch Access

> Grant users access to OpenSearch dashboards and centralized logs

<Warning>
  **VPN Access Required**:\
  Ensure your VPN (Virtual Private Network) connection is active before attempting to access OpenSearch.
</Warning>

## Overview

Users access OpenSearch through two main mechanisms:

* **Single Sign-On (SSO) Integration** – Authentication is handled via AWS IAM Identity Center
* **Role-Based Access Control (RBAC)** – Users are mapped to roles that define what they can see and do

***

## Configure SSO Access

<Steps>
  <Step title="Assign groups to the Logs application">
    In the **infrastructure AWS account**:

    1. Go to **AWS Identity Center** → **Applications** → **Customer managed**
    2. Find and open the **Logs** application
    3. Click **Assign users and groups**
    4. Switch to the **Groups** tab
    5. Select the access groups that need OpenSearch access
    6. Click **Assign**
  </Step>

  <Step title="Log in as an Administrator">
    From your SSO portal, open the **Logs** application using an account that belongs to the **Administrators** group.\
    This lets you configure role mappings inside OpenSearch.
  </Step>

  <Step title="Map groups to OpenSearch roles">
    In OpenSearch:

    1. Open the hamburger menu (☰)
    2. Navigate to **Security** → **Roles**
    3. Click **Explore existing roles**
    4. Locate the appropriate role for your group:
       * `development_access` – Development environment access
       * `production_access` – Production environment access
       * `readall_and_monitor` – Read-only log access

    <Frame>
      <img src="https://mintcdn.com/nimblela/ea2QNTeaYGlkE_vd/images/user-management/opensearch-roles.jpg?fit=max&auto=format&n=ea2QNTeaYGlkE_vd&q=85&s=be9546ad7a53b819cf1591d3ec20c13f" alt="OpenSearch role configuration" width="1914" height="548" data-path="images/user-management/opensearch-roles.jpg" />
    </Frame>
  </Step>

  <Step title="Add backend role mappings">
    For each OpenSearch role you want to assign:

    1. Open the role (e.g., `development_developers`)
    2. Go to the **Mapped users** tab
    3. Click **Manage mapping**
    4. Select **Add another backend role**
    5. Enter the AWS IAM Identity Center **Group ID** (format: `1234abcd-56ef-78gh-90ij-klmnop123456`)
    6. Click **Map**

    <Note>
      You can find the **Group ID** in AWS Identity Center under **Groups → \[Group Name] → Details**.
    </Note>

    <Note>
      Multiple SSO groups can be mapped to the same OpenSearch role.
    </Note>
  </Step>
</Steps>

***

## Common OpenSearch Roles

<Tabs>
  <Tab title="Development Developers">
    **Role**: `development_developers`

    **Permissions**:

    * Read access to development logs
    * Create and modify development dashboards
    * Export development data

    **Typical Groups**:

    * DevelopmentTeam
    * QATeam
  </Tab>

  <Tab title="Production Developers">
    **Role**: `production_developers`

    **Permissions**:

    * Read access to production logs
    * Create and modify production dashboards
    * Export production data
    * Limited administrative functions

    **Typical Groups**:

    * Production Developers Team
    * SeniorDevelopers
    * Cloud Engineers
  </Tab>
</Tabs>

***

## Troubleshooting OpenSearch Access

<Warning>
  Changes to role mappings may take several minutes to take effect.\
  Users may need to refresh their browser or log out and back in.
</Warning>

<AccordionGroup>
  <Accordion title="User can't access Logs application">
    **Possible causes:**

    * User's group is not assigned to the Logs application
    * User credentials need to be refreshed – Log in again
    * Group membership changes are still propagating

    **How to fix:**

    1. Verify group assignment in AWS Identity Center
    2. Ask the user to log out and back in
    3. Wait 15–30 minutes for changes to propagate
  </Accordion>

  <Accordion title="User sees 'Access Denied' in OpenSearch">
    **Possible causes:**

    * Group is not mapped to any OpenSearch role
    * Wrong role was mapped for their access level
    * Group ID entered incorrectly

    **How to fix:**

    1. Check role mappings in OpenSearch Security
    2. Confirm the correct Group ID from Identity Center
    3. Verify that the mapped role grants the required permissions
  </Accordion>

  <Accordion title="User can't see expected log data">
    **Possible causes:**

    * Role does not grant access to required indices
    * Retention policies have removed older logs
    * Logs have not yet been ingested

    **How to fix:**

    1. Check role permissions for relevant indices
    2. Review log retention settings
    3. Confirm log ingestion pipeline is working
  </Accordion>
</AccordionGroup>

***

## Best Practices

<Check>
  * **Principle of Least Privilege** – Assign only the minimum access required
  * **Separate environments** – Use different roles for development vs. production
  * **Review access regularly** – Especially for production logs
  * **Document role purposes** – Maintain a clear record of what each role is for
</Check>