Configuring access to Object Storage from an OpenSearch cluster

Managed Service for OpenSearch supports using Yandex Object Storage as an OpenSearch snapshot repository. This allows you to use Object Storage to store backups. For more about the snapshot repository, see this OpenSearch guide.

To access Object Storage bucket data from a cluster:

1. Attach the service account to the cluster.
2. Configure access permissions.
3. Add a snapshot repository.

Before you begin, assign the iam.serviceAccounts.user role or higher to your Yandex Cloud account. You will need this role in the following cases:

• To create or update a cluster and attach a service account to it.
• To restore a cluster attached to a service account from its backup.

Attach the service account to the clusterAttach the service account to the cluster

1. When creating or updating a cluster, either select an existing service account or create a new one.

2. Assign the storage.editor role to this account.

Configure access permissionsConfigure access permissions

Add a snapshot repositoryAdd a snapshot repository

1. Connect to the cluster.

2. Register the bucket as a snapshot repository using the public OpenSearch API:

   PUT --cacert ~/.opensearch/root.crt https://admin:<password>@<ID_of_OpenSearch_host_with_DATA_role>.mdb.yandexcloud.net:9200/_snapshot/<repository_name>
   

   In the request parameters, specify the bucket associated with the cluster service account:

   curl --request PUT \
        "https://admin:<password>@<ID_of_OpenSearch_host_with_DATA_role>.mdb.yandexcloud.net:9200/_snapshot/<repository_name>" \
        --cacert ~/.opensearch/root.crt \
        --header "Content-Type: application/json" \
        --data '{
          "type": "s3",
          "settings": {
            "endpoint": "storage.yandexcloud.net",
            "bucket": "<bucket_name>"
          }
        }'