Making a user or role with elasticsearch-py in AWS - amazon-web-services

Question

I'm trying to create users and roles via the elasticsearch python client documented here: https://elasticsearch-py.readthedocs.io/en/v7.14.1/. If I use HTTP requests alone and if I ignore the certificates, I can reach the application and make requests with the payloads suggested in https://opendistro.github.io/for-elasticsearch-docs/docs/security/access-control/api/. However I'm trying to use a secure connection to get to elasticsearch in AWS. According to their documentation in https://docs.aws.amazon.com/opensearch-service/latest/developerguide/request-signing.html#request-signing-python, I should be using the elastic search client like this:
region = 'my-region-1'
service = 'opensearchservice'
credentials = boto3.Session().get_credentials()
awsauth = AWS4Auth(credentials.access_key, credentials.secret_key, region, service,
session_token=credentials.token)
elasticsearch = Elasticsearch(
hosts=[{'host': self._host, 'port': 443}],
http_auth=awsauth,
use_ssl=True,
verify_certs=True,
connection_class=RequestsHttpConnection
)
I'm using boto3 to create the session and AWS4Auth to try and get the secure connection. However, I can't find anywhere how to actually send a plain payload to elastic search endpoints. For example, for this endpoint:
curl -X PUT http://localhost:443/_opendistro/_security/api/roles/jesperancinha-role -d "{}" (...)
It seems like that we need to send an index and that's not what I'm looking for. I just want to create a user with a payload like this one:
{
"cluster_permissions" : [
"indices_monitor",
],
"index_permissions" : [
{
"index_patterns" : [
"*"
],
"dls" : "",
"fls" : [ ],
"masked_fields" : [ ],
"allowed_actions" : [
"read",
"indices:monitor/stats"
]
}
],
"tenant_permissions" : [
{
"tenant_patterns" : [
"human_resources"
],
"allowed_actions" : [
"kibana_all_read"
]
}
]
}
It would be great if this could be done via the elasticsearch-py client, but if you have any other idea, please let me know. Thanks!

Answer 1

I hope I didn't get people too confused with my question. I finally found out what I wanted. The elasticsearch client does work, but only for searches and indexing. For administrator tasks, I found out that I need to make normal requests as described in the open distro for elastic search, except that they also need to be signed with Signature Version 4. The whole thing is pretty complicated but very nicely layed out in the AWS website: https://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html.