Alibaba Cloud ES service role - Elasticsearch - Alibaba Cloud Documentation Center

If your plugin or dictionary source file is stored in Object Storage Service (OSS), you can upload it by providing the OSS address in the Elasticsearch (ES) console. To do so, you must grant ES access to the specified OSS path through a service role.

Introduction to the ES service role

Note

A service role is a type of Resource Access Management (RAM) role where the trusted entity is an Alibaba Cloud service. It is designed to authorize access across different Alibaba Cloud services. For more information, see RAM role overview.

When you update a dictionary by providing an OSS path in the console and no role with the required permissions exists, you must authorize the creation of a service role. ES assumes this role to access the file at the specified OSS path and update the dictionary in your ES instance, without requiring the OSS bucket to be set to public-read.

The details of this role are as follows:

Service name: elasticsearch.aliyuncs.com
Role name: AliyunElasticsearchAccessingOSSRole
Access policy name: AliyunElasticsearchAccessingOSSRolePolicy

Role policy document

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "oss:GetObject",
        "oss:GetObjectMetadata",
        "oss:GetObjectMeta"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

Delete the service role

To delete the service role, go to the Resource Access Management (RAM) console. For more information, see Delete a RAM role.

Note

After you delete the service role, features that depend on it will not function correctly. Proceed with caution.

Example: Restrict service role permissions

To limit what the service role can access, customize its authorization policy as follows:

Set bucket tags

Use bucket tags to manage permissions for OSS buckets. For more information, see Manage bucket tags.
1. Log on to the OSS console.
2. In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.
3. In the left-side navigation pane, choose Bucket Settings > Bucket Tagging.
4. On the Bucket Tagging page, click Create Tag.
5. Set the bucket tag.

Create a RAM policy. For more information, see Create a custom policy in script mode.

Modify the Resource element to restrict access to a specific bucket, or the Condition element to restrict access to buckets with a specific tag. Example:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "oss:GetObject",
        "oss:GetObjectMetadata",
        "oss:GetObjectMeta"
      ],
      "Resource": [
        "acs:oss:*:193248xxxxxxx:*"
      ],
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "oss:BucketTag/key1":"value1"
        }
      }
    }
  ]
}

You can edit the permissions of AliyunElasticsearchAccessingOSSRole and add the custom policy that you created in the previous step.

FAQ

Q: Why do I receive the error code ElasticsearchNoPermissionForCurrentBucket when I make OpenAPI requests such as UpdateDict, UpdateHotIkDicts, UpdateSynonymsDicts, or UpdateAliwsDict?

A: Cloud-native control instances (versions 7.16, 8.5, and 8.9) can read dictionary files from OSS only through an Alibaba Cloud service role. Direct access to public-read OSS addresses is not supported. Go to the authorization page to grant the required permissions. This applies to synonym updates, IK dictionary cold and hot updates, and ali-ws dictionary updates from OSS.