OpenSearch/ElasticSearch - Authorisation error removing alias using only a wildcard - elasticsearch

Question

I'm trying to do something fairly simple - I have an alias that may be associated with one or more indices and I want to remove all associations and add a single one. Here is an example of what I'm doing (as suggested in here):
POST _aliases
{
"actions": [
{
"remove": {
"index": "*", // or "index": "_all"
"alias": "my_index"
}
},
{
"add": {
"index": "my_index_2023_01_05_17_18_29",
"alias": "my_index"
}
}
]
}
I'm using an admin user and for some reason I'm getting the following error message:
{
"error" : {
"root_cause" : [
{
"type" : "security_exception",
"reason" : "no permissions for [] and User [name=admin, backend_roles=[], requestedTenant=]"
}
],
"type" : "security_exception",
"reason" : "no permissions for [] and User [name=admin, backend_roles=[], requestedTenant=]"
},
"status" : 403
}
Kind of weird message - it doesn't specify what's the action that is failing (no permissions for []) so I cannot figure out which permissions I'm missing...
Either way, if instead of using the wildcard like that ("index": "*"), I do something like "index": "my_index*" it works - It is not exactly what I want but it executes.
Any idea why this might be happening and how can I solve this?
Thanks!
(Using OpenSearch 2.3)

Answer 1

When you specify index_pattern as "*", system indexes are also included. Even with the admin user, you cannot change the settings of the system indexes by default. You can delete the alias by using parameters like "index_name"* or "2022" instead of "*".
For example:
POST _aliases
{
"actions": [
{
"remove": {
"index": "index_name*",
"alias": "my_index"
}
}
]
}
Edit:
You can use the following API to remove all aliases without system indices.
DELETE *,.-*/_alias/my-alias
You can check if the API is correct before removing them
GET *,-.*/_alias/my-alias
Ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-alias.html
Note: Unfortunately, it's not possible to use an expression like *,.-* in the POST _aliases body.