Kvindo™ Cloud Docs
An OpenSearch User is an authenticated tenant identity inside one OpenSearch cluster: a security-plugin user with password authentication, index-pattern grants, and deliberately no cluster administration.
• Cluster-bound — a user belongs exclusively to its parent OpenSearch cluster for its whole lifetime; the cluster reference is immutable after creation
• The login is metadata.name — 1–64 characters of [a-z][a-z0-9_-]. The plugin's own accounts (admin, kibanaserver, logstash, snapshotrestore) and anything under the platform's kc_ prefix are refused, so a tenant identity can never shadow a shipped account or a platform-managed security object
• Index grants, not cluster rights — every grant names one index pattern and one role. ReadOnly gets read; ReadWrite gets read, write, create_index, delete and manage — never indices_all, which is the index-level equivalent of handing over a wildcard. There is no Admin or all-access role: a tenant principal must never hold cluster administration, which is what makes the parameter allow-list a real boundary rather than a suggestion
• Pattern type is explicit — Literal uses your pattern verbatim, so your own * and ? remain yours; Prefixed appends exactly one * to what you wrote. Two types rather than one auto-detected behaviour, because logs-* is a perfectly legitimate literal pattern
• No grants means no access — a null or empty indexGrants is the honest description of a user who authenticates and can then do nothing. It is what you get if the field is forgotten, so send it deliberately
• Disabled locks the credential, it does not delete it — spec.enabled = false replaces the stored hash with a random, unusable one and keeps the role mapping, so re-enabling is a single write. Nothing about the user is removed
• The password is write-only and is re-sent on every change — it is never returned on read, so store it when you set it. A user change re-dispatches the entire cluster, so the platform re-reads each user's stored password rather than sending a null: an enabled user whose password arrives as null is an error, never a silent lock
• TLS only — a user connects to port 9200 over TLS and pins the cluster CA from status.caCertificate. There is no plaintext listener to fall back to
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| OpenSearch cluster | spec.openSearchId |
spec.opensearch_id |
No | ULID — references an OpenSearch Cluster | — | No | The parent cluster this user lives in. Immutable after creation |
| Password | spec.password |
spec.password |
Yes | string | — | No | Password for authentication (write-only, never returned on read, and required on every whole-cluster dispatch) |
| Enabled | spec.enabled |
spec.enabled |
Yes | boolean | true |
No | Whether the account can authenticate. false locks the credential by replacing its stored hash, and keeps the role mapping |
| Index grants | spec.indexGrants |
spec.index_grants |
Yes | list of objects | — | No | Per-pattern permissions. Null or empty means the user authenticates and can do nothing |
| Index pattern | indexGrants[].indexPattern |
index_grants[].index_pattern |
No | string (≤255) | — | No | The index pattern this grant applies to |
| Pattern type | indexGrants[].patternType |
index_grants[].pattern_type |
No | string | Literal |
No | Literal — the pattern verbatim · Prefixed — one * appended to it |
| Role | indexGrants[].role |
index_grants[].role |
No | string | ReadOnly |
No | ReadOnly (read) or ReadWrite (read, write, create_index, delete, manage). There is no admin role |
Any OpenSearch client works, as long as it trusts the cluster CA from status.caCertificate and connects to 9200 — which is TLS-only, so a client that skips the CA does not get a helpful error, only a failed connection. Seed its host list from status.restEndpoints, or from status.restPublicEndpoints on a cluster whose data nodes carry a floating IP.
A shipping user that writes to the logs- prefix and can only read the dated logs-2026.* indices.
Terraform
Python SDK
kc CLI
Resource docs
Examples