Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Opensearch Provider
  3. API Docs
  4. Role
opensearch 2.3.1 published on Monday, Apr 14, 2025 by opensearch-project
opensearch-project/terraform-provider-opensearch

opensearch.Role

Explore with Pulumi AI

opensearch logo
opensearch 2.3.1 published on Monday, Apr 14, 2025 by opensearch-project
opensearch-project/terraform-provider-opensearch

    Provides an OpenSearch security role resource. Please refer to the OpenSearch Access Control documentation for details.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as opensearch from "@pulumi/opensearch";

// To set document level permissions:
const writer = new opensearch.Role("writer", {
    clusterPermissions: ["*"],
    indexPermissions: [{
        allowedActions: ["read"],
        documentLevelSecurity: "{\"term\": { \"readable_by\": \"${user.name}\"}}",
        indexPatterns: ["pub*"],
    }],
    roleName: "foo_writer",
});

    import pulumi
import pulumi_opensearch as opensearch

# To set document level permissions:
writer = opensearch.Role("writer",
    cluster_permissions=["*"],
    index_permissions=[{
        "allowed_actions": ["read"],
        "document_level_security": "{\"term\": { \"readable_by\": \"${user.name}\"}}",
        "index_patterns": ["pub*"],
    }],
    role_name="foo_writer")

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/opensearch/v2/opensearch"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// To set document level permissions:
		_, err := opensearch.NewRole(ctx, "writer", &opensearch.RoleArgs{
			ClusterPermissions: pulumi.StringArray{
				pulumi.String("*"),
			},
			IndexPermissions: opensearch.RoleIndexPermissionArray{
				&opensearch.RoleIndexPermissionArgs{
					AllowedActions: pulumi.StringArray{
						pulumi.String("read"),
					},
					DocumentLevelSecurity: pulumi.String("{\"term\": { \"readable_by\": \"${user.name}\"}}"),
					IndexPatterns: pulumi.StringArray{
						pulumi.String("pub*"),
					},
				},
			},
			RoleName: pulumi.String("foo_writer"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Opensearch = Pulumi.Opensearch;

return await Deployment.RunAsync(() => 
{
    // To set document level permissions:
    var writer = new Opensearch.Role("writer", new()
    {
        ClusterPermissions = new[]
        {
            "*",
        },
        IndexPermissions = new[]
        {
            new Opensearch.Inputs.RoleIndexPermissionArgs
            {
                AllowedActions = new[]
                {
                    "read",
                },
                DocumentLevelSecurity = "{\"term\": { \"readable_by\": \"${user.name}\"}}",
                IndexPatterns = new[]
                {
                    "pub*",
                },
            },
        },
        RoleName = "foo_writer",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.opensearch.Role;
import com.pulumi.opensearch.RoleArgs;
import com.pulumi.opensearch.inputs.RoleIndexPermissionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // To set document level permissions:
        var writer = new Role("writer", RoleArgs.builder()
            .clusterPermissions("*")
            .indexPermissions(RoleIndexPermissionArgs.builder()
                .allowedActions("read")
                .documentLevelSecurity("{\"term\": { \"readable_by\": \"${user.name}\"}}")
                .indexPatterns("pub*")
                .build())
            .roleName("foo_writer")
            .build());

    }
}

    resources:
  # To set document level permissions:
  writer:
    type: opensearch:Role
    properties:
      clusterPermissions:
        - '*'
      indexPermissions:
        - allowedActions:
            - read
          documentLevelSecurity: '{"term": { "readable_by": "$${user.name}"}}'
          indexPatterns:
            - pub*
      roleName: foo_writer

    Create Role Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Role(name: string, args: RoleArgs, opts?: CustomResourceOptions);
    @overload
def Role(resource_name: str,
         args: RoleArgs,
         opts: Optional[ResourceOptions] = None)

@overload
def Role(resource_name: str,
         opts: Optional[ResourceOptions] = None,
         role_name: Optional[str] = None,
         cluster_permissions: Optional[Sequence[str]] = None,
         description: Optional[str] = None,
         index_permissions: Optional[Sequence[RoleIndexPermissionArgs]] = None,
         role_id: Optional[str] = None,
         tenant_permissions: Optional[Sequence[RoleTenantPermissionArgs]] = None)
    func NewRole(ctx *Context, name string, args RoleArgs, opts ...ResourceOption) (*Role, error)
    public Role(string name, RoleArgs args, CustomResourceOptions? opts = null)
    public Role(String name, RoleArgs args)
public Role(String name, RoleArgs args, CustomResourceOptions options)

    type: opensearch:Role
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args RoleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args RoleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args RoleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args RoleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args RoleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var roleResource = new Opensearch.Role("roleResource", new()
{
    RoleName = "string",
    ClusterPermissions = new[]
    {
        "string",
    },
    Description = "string",
    IndexPermissions = new[]
    {
        new Opensearch.Inputs.RoleIndexPermissionArgs
        {
            AllowedActions = new[]
            {
                "string",
            },
            DocumentLevelSecurity = "string",
            FieldLevelSecurities = new[]
            {
                "string",
            },
            IndexPatterns = new[]
            {
                "string",
            },
            MaskedFields = new[]
            {
                "string",
            },
        },
    },
    RoleId = "string",
    TenantPermissions = new[]
    {
        new Opensearch.Inputs.RoleTenantPermissionArgs
        {
            AllowedActions = new[]
            {
                "string",
            },
            TenantPatterns = new[]
            {
                "string",
            },
        },
    },
});

    example, err := opensearch.NewRole(ctx, "roleResource", &opensearch.RoleArgs{
	RoleName: pulumi.String("string"),
	ClusterPermissions: pulumi.StringArray{
		pulumi.String("string"),
	},
	Description: pulumi.String("string"),
	IndexPermissions: opensearch.RoleIndexPermissionArray{
		&opensearch.RoleIndexPermissionArgs{
			AllowedActions: pulumi.StringArray{
				pulumi.String("string"),
			},
			DocumentLevelSecurity: pulumi.String("string"),
			FieldLevelSecurities: pulumi.StringArray{
				pulumi.String("string"),
			},
			IndexPatterns: pulumi.StringArray{
				pulumi.String("string"),
			},
			MaskedFields: pulumi.StringArray{
				pulumi.String("string"),
			},
		},
	},
	RoleId: pulumi.String("string"),
	TenantPermissions: opensearch.RoleTenantPermissionArray{
		&opensearch.RoleTenantPermissionArgs{
			AllowedActions: pulumi.StringArray{
				pulumi.String("string"),
			},
			TenantPatterns: pulumi.StringArray{
				pulumi.String("string"),
			},
		},
	},
})

    var roleResource = new Role("roleResource", RoleArgs.builder()
    .roleName("string")
    .clusterPermissions("string")
    .description("string")
    .indexPermissions(RoleIndexPermissionArgs.builder()
        .allowedActions("string")
        .documentLevelSecurity("string")
        .fieldLevelSecurities("string")
        .indexPatterns("string")
        .maskedFields("string")
        .build())
    .roleId("string")
    .tenantPermissions(RoleTenantPermissionArgs.builder()
        .allowedActions("string")
        .tenantPatterns("string")
        .build())
    .build());

    role_resource = opensearch.Role("roleResource",
    role_name="string",
    cluster_permissions=["string"],
    description="string",
    index_permissions=[{
        "allowed_actions": ["string"],
        "document_level_security": "string",
        "field_level_securities": ["string"],
        "index_patterns": ["string"],
        "masked_fields": ["string"],
    }],
    role_id="string",
    tenant_permissions=[{
        "allowed_actions": ["string"],
        "tenant_patterns": ["string"],
    }])

    const roleResource = new opensearch.Role("roleResource", {
    roleName: "string",
    clusterPermissions: ["string"],
    description: "string",
    indexPermissions: [{
        allowedActions: ["string"],
        documentLevelSecurity: "string",
        fieldLevelSecurities: ["string"],
        indexPatterns: ["string"],
        maskedFields: ["string"],
    }],
    roleId: "string",
    tenantPermissions: [{
        allowedActions: ["string"],
        tenantPatterns: ["string"],
    }],
});

    type: opensearch:Role
properties:
    clusterPermissions:
        - string
    description: string
    indexPermissions:
        - allowedActions:
            - string
          documentLevelSecurity: string
          fieldLevelSecurities:
            - string
          indexPatterns:
            - string
          maskedFields:
            - string
    roleId: string
    roleName: string
    tenantPermissions:
        - allowedActions:
            - string
          tenantPatterns:
            - string

    Role Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Role resource accepts the following input properties:

    RoleName string
    The name of the security role.
    ClusterPermissions List<string>
    A list of cluster permissions.
    Description string
    Description of the role.
    IndexPermissions List<RoleIndexPermission>
    A configuration of index permissions
    RoleId string
    The ID of this resource.
    TenantPermissions List<RoleTenantPermission>
    A configuration of tenant permissions
    RoleName string
    The name of the security role.
    ClusterPermissions []string
    A list of cluster permissions.
    Description string
    Description of the role.
    IndexPermissions []RoleIndexPermissionArgs
    A configuration of index permissions
    RoleId string
    The ID of this resource.
    TenantPermissions []RoleTenantPermissionArgs
    A configuration of tenant permissions
    roleName String
    The name of the security role.
    clusterPermissions List<String>
    A list of cluster permissions.
    description String
    Description of the role.
    indexPermissions List<RoleIndexPermission>
    A configuration of index permissions
    roleId String
    The ID of this resource.
    tenantPermissions List<RoleTenantPermission>
    A configuration of tenant permissions
    roleName string
    The name of the security role.
    clusterPermissions string[]
    A list of cluster permissions.
    description string
    Description of the role.
    indexPermissions RoleIndexPermission[]
    A configuration of index permissions
    roleId string
    The ID of this resource.
    tenantPermissions RoleTenantPermission[]
    A configuration of tenant permissions
    role_name str
    The name of the security role.
    cluster_permissions Sequence[str]
    A list of cluster permissions.
    description str
    Description of the role.
    index_permissions Sequence[RoleIndexPermissionArgs]
    A configuration of index permissions
    role_id str
    The ID of this resource.
    tenant_permissions Sequence[RoleTenantPermissionArgs]
    A configuration of tenant permissions
    roleName String
    The name of the security role.
    clusterPermissions List<String>
    A list of cluster permissions.
    description String
    Description of the role.
    indexPermissions List<Property Map>
    A configuration of index permissions
    roleId String
    The ID of this resource.
    tenantPermissions List<Property Map>
    A configuration of tenant permissions

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Role resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing Role Resource

    Get an existing Role resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: RoleState, opts?: CustomResourceOptions): Role
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        cluster_permissions: Optional[Sequence[str]] = None,
        description: Optional[str] = None,
        index_permissions: Optional[Sequence[RoleIndexPermissionArgs]] = None,
        role_id: Optional[str] = None,
        role_name: Optional[str] = None,
        tenant_permissions: Optional[Sequence[RoleTenantPermissionArgs]] = None) -> Role
    func GetRole(ctx *Context, name string, id IDInput, state *RoleState, opts ...ResourceOption) (*Role, error)
    public static Role Get(string name, Input<string> id, RoleState? state, CustomResourceOptions? opts = null)
    public static Role get(String name, Output<String> id, RoleState state, CustomResourceOptions options)
    resources:  _:    type: opensearch:Role    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ClusterPermissions List<string>
    A list of cluster permissions.
    Description string
    Description of the role.
    IndexPermissions List<RoleIndexPermission>
    A configuration of index permissions
    RoleId string
    The ID of this resource.
    RoleName string
    The name of the security role.
    TenantPermissions List<RoleTenantPermission>
    A configuration of tenant permissions
    ClusterPermissions []string
    A list of cluster permissions.
    Description string
    Description of the role.
    IndexPermissions []RoleIndexPermissionArgs
    A configuration of index permissions
    RoleId string
    The ID of this resource.
    RoleName string
    The name of the security role.
    TenantPermissions []RoleTenantPermissionArgs
    A configuration of tenant permissions
    clusterPermissions List<String>
    A list of cluster permissions.
    description String
    Description of the role.
    indexPermissions List<RoleIndexPermission>
    A configuration of index permissions
    roleId String
    The ID of this resource.
    roleName String
    The name of the security role.
    tenantPermissions List<RoleTenantPermission>
    A configuration of tenant permissions
    clusterPermissions string[]
    A list of cluster permissions.
    description string
    Description of the role.
    indexPermissions RoleIndexPermission[]
    A configuration of index permissions
    roleId string
    The ID of this resource.
    roleName string
    The name of the security role.
    tenantPermissions RoleTenantPermission[]
    A configuration of tenant permissions
    cluster_permissions Sequence[str]
    A list of cluster permissions.
    description str
    Description of the role.
    index_permissions Sequence[RoleIndexPermissionArgs]
    A configuration of index permissions
    role_id str
    The ID of this resource.
    role_name str
    The name of the security role.
    tenant_permissions Sequence[RoleTenantPermissionArgs]
    A configuration of tenant permissions
    clusterPermissions List<String>
    A list of cluster permissions.
    description String
    Description of the role.
    indexPermissions List<Property Map>
    A configuration of index permissions
    roleId String
    The ID of this resource.
    roleName String
    The name of the security role.
    tenantPermissions List<Property Map>
    A configuration of tenant permissions

    Supporting Types

    RoleIndexPermission, RoleIndexPermissionArgs

    AllowedActions List<string>
    A list of allowed actions.
    DocumentLevelSecurity string
    A selector for document-level security (json formatted using jsonencode).
    FieldLevelSecurities List<string>
    A list of selectors for field-level security.
    IndexPatterns List<string>
    A list of glob patterns for the index names.
    MaskedFields List<string>
    A list of masked fields
    AllowedActions []string
    A list of allowed actions.
    DocumentLevelSecurity string
    A selector for document-level security (json formatted using jsonencode).
    FieldLevelSecurities []string
    A list of selectors for field-level security.
    IndexPatterns []string
    A list of glob patterns for the index names.
    MaskedFields []string
    A list of masked fields
    allowedActions List<String>
    A list of allowed actions.
    documentLevelSecurity String
    A selector for document-level security (json formatted using jsonencode).
    fieldLevelSecurities List<String>
    A list of selectors for field-level security.
    indexPatterns List<String>
    A list of glob patterns for the index names.
    maskedFields List<String>
    A list of masked fields
    allowedActions string[]
    A list of allowed actions.
    documentLevelSecurity string
    A selector for document-level security (json formatted using jsonencode).
    fieldLevelSecurities string[]
    A list of selectors for field-level security.
    indexPatterns string[]
    A list of glob patterns for the index names.
    maskedFields string[]
    A list of masked fields
    allowed_actions Sequence[str]
    A list of allowed actions.
    document_level_security str
    A selector for document-level security (json formatted using jsonencode).
    field_level_securities Sequence[str]
    A list of selectors for field-level security.
    index_patterns Sequence[str]
    A list of glob patterns for the index names.
    masked_fields Sequence[str]
    A list of masked fields
    allowedActions List<String>
    A list of allowed actions.
    documentLevelSecurity String
    A selector for document-level security (json formatted using jsonencode).
    fieldLevelSecurities List<String>
    A list of selectors for field-level security.
    indexPatterns List<String>
    A list of glob patterns for the index names.
    maskedFields List<String>
    A list of masked fields

    RoleTenantPermission, RoleTenantPermissionArgs

    AllowedActions List<string>
    A list of allowed actions.
    TenantPatterns List<string>
    A list of glob patterns for the tenant names
    AllowedActions []string
    A list of allowed actions.
    TenantPatterns []string
    A list of glob patterns for the tenant names
    allowedActions List<String>
    A list of allowed actions.
    tenantPatterns List<String>
    A list of glob patterns for the tenant names
    allowedActions string[]
    A list of allowed actions.
    tenantPatterns string[]
    A list of glob patterns for the tenant names
    allowed_actions Sequence[str]
    A list of allowed actions.
    tenant_patterns Sequence[str]
    A list of glob patterns for the tenant names
    allowedActions List<String>
    A list of allowed actions.
    tenantPatterns List<String>
    A list of glob patterns for the tenant names

    Import

    $ pulumi import opensearch:index/role:Role writer logs_writer

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    opensearch opensearch-project/terraform-provider-opensearch
    License
    Notes
    This Pulumi package is based on the opensearch Terraform Provider.
    opensearch logo
    opensearch 2.3.1 published on Monday, Apr 14, 2025 by opensearch-project
    opensearch-project/terraform-provider-opensearch