resource "opensearch_role" "default_role" {
  role_name   = "default_role"
  description = "Default role for all IAM based users."

  cluster_permissions = [
    "cluster_all",
    # explicitly grant these as they seem to be missing after granting cluster_all.
    "indices:data/read/scroll",
    "indices:data/read/search",
    "indices:data/write/bulk",
    "indices:data/write/reindex",
    "indices:admin/template/get",
  ]

  index_permissions {
    index_patterns  = ["*"]
    allowed_actions = ["indices_all"]
  }

  tenant_permissions {
    tenant_patterns = ["global_tenant"]
    allowed_actions = ["kibana_all_write"]
  }

}

# This is all the permissions needed for opensearch-sink connector to work.
resource "opensearch_role" "vectororder_detail_index_rw" {
  role_name   = "vectororder-detail-index-rw"
  description = "Read/Write/search role for vectororder_detail_write alias"

  cluster_permissions = ["cluster_composite_ops"]

  index_permissions {
    index_patterns       = ["vectororder_detail_write"]
    allowed_actions      = ["indices_all"]
    field_level_security = []
    masked_fields        = []
  }
}