Hey all, I set up a separate Elastic Search instance on AWS to use with Datahub, but when I use its host:port I got the following error on the GMS pod:

2022/08/02 01:34:44 Received 400 from <http://search-datahub-elasticsearch-foobar.us-west-2.es.amazonaws.com:443>. Sleeping 1s

I used

ELASTICSEARCH_HOST

and

ELASTICSEARCH_PORT

env variables in the GMS deployment (I used Kustomize). Any idea?

looks like there is some misconfiguration , the url you configured http://search-datahub-elasticsearch-foobar.us-west-2.es.amazonaws.com:443/ is using port 443 with http protocol which is wrong http work with 80 protocol

Thanks Navin, I’m not getting 400 anymore with port 80 but getting this following 403, also I’m not using helm chart so how can I apply the elasticsearchSetupJob to the config?

Received 403 from <http://search-datahub-elasticsearch-i2zymt4u4yi7jgag7gtpkizkpa.us-west-2.es.amazonaws.com:80>. Sleeping 1s

^ you could just run that job/container a single time and point it to your ES cluster. It is only required to run once

@average-vr-23088 I’m not using helm but Kustomize instead @green-football-43791 unfortunately adding

ELASTICSEARCH_USERNAME

ELASTICSEARCH_PASSWORD

to the env still didn’t help, I’m still getting 403 like the above 😭

how have you deployed Elastic Search? is it the AWS managed one?

Yes

did you enable the internal user database on OpenSearch?

oh, I created a master user and provided username/password to GMS. Should I not do that?

there are few ways to configure security for OpenSearch, one is if you set

TheMasterUser

to an IAM role, typically used with Cognito. Another is if you enable the internal user database with fine-grained access control. In that scenario, if OpenSearch is public and you set up the right resource policy, it can support HTTP basic auth. The first setup doesn’t support HTTP basic auth, it forces you to do signed requests to the ElasticSearch API — something datahub doesn’t support

I see, so the only option is to enable the internal user database with fine-grained access control? The link you sent is still using

TheMasterUser

, but without Cognito right?

thats right. You’d have to use a cluster that is configured to be public and support HTTP Basic auth, using that fine grained access control setup i linked to. It would be nice if DataHub supported doing signed requests but I can see how that would make it fairly specific to AWS OpenSearch

Thank you! Do you know where can I “Sign in using theMasterUser” ? I don’t see that option anywhere in my OpenSearch Dashboard https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac-walkthrough-basic.html

2. Navigate to OpenSearch Dashboards.
3. Sign in using TheMasterUser.