Error: HEAD healthcheck failed: This is usually due to network or permission issues

[Richard-Payne]

We have a previously configured Opensearch cluster in Terraform. I'm now trying to make a change to it.
Run terraform plan produces:

Error: HEAD healthcheck failed: This is usually due to network or permission issues. The underlying error isn't accessible, please debug by disabling healthchecks.

Settting TF_LOG_PROVIDER=INFO produces this:

2024-10-08T10:52:34.937+0100 [INFO] provider.terraform-provider-elasticsearch_v2.0.2: 2024/10/08 10:52:34 [INFO] couldn't create client: *errors.withStack, no active connection found: no Elasticsearch node available, *errors.withMessage: timestamp=2024-10-08T10:52:34.937+0100

The provider config is:

provider "elasticsearch" {
  url                     = "https://${aws_opensearch_domain.this.endpoint}"
  aws_profile       = "prod"
  username          = null
  password          = null
  sign_aws_requests = null
  healthcheck       = false
}

I pulled the endpoint attribute out of the tf state record and I can curl it successfully, using https, returning the usual cluster information json blob.

Any help resolving this would be appreicated.

[mdhifallah]

same here

[rishabhToshniwal]

I am also facing the similar issue

Error: HEAD healthcheck failed: This is usually due to network or permission issues. The underlying error isn't accessible, please debug by disabling healthchecks.
│
│ with elasticsearch_opensearch_roles_mapping.security_manager["security_manager"],
│ on logging.tf line 290, in resource "elasticsearch_opensearch_roles_mapping" "security_manager":
│ 290: resource "elasticsearch_opensearch_roles_mapping" "security_manager" {

The Provider is configured as under

provider "elasticsearch" {
  alias = "sign_aws_requests_true"
  url = var.is_AwsOpenSearch_Required ? "https://${module.es-logging[0].endpoint}" : ""
  sign_aws_requests = true
  aws_region =  var.aws_region
  healthcheck         =  var.fgac_enabled ? false: true
  username =  var.is_AwsOpenSearch_Required && var.fgac_enabled ?module.secret_manager.random_passwords[var.fgac_master_user_name].result : ""
  password = var.is_AwsOpenSearch_Required && var.fgac_enabled ? module.secret_manager.random_passwords[var.fgac_master_password].result : ""
}

The provider is used to create internal roles mapping in OpenSearch and it has dependency set on module.es-logging

resource "elasticsearch_opensearch_roles_mapping" "security_manager" {
  provider = **elasticsearch.sign_aws_requests_false**

  for_each = var.is_AwsOpenSearch_Required && var.fgac_enabled ? local.role_mappings.security_mappings : {}

  role_name = each.key
  backend_roles = each.value.backend_roles
  users =  each.value.users

  depends_on = [module.es-logging,null_resource.enable_compatibility_mode,null_resource.validate_logging_es[0]]
}

However when we set is_AwsOpenSearch_Required as false, the expectation is to destroy internal roles in Opensearch and then the Opensearch domain created by module.es-logging. But It seems to me that the module.es-logging[0].endpoint becomes empty even before destroying the internal roles.