[DOC] [New Doc] Document API rate-limiting as customer control for open-sourced OpenSearch.

[DarshitChanpura]

Coming from a recent identification, there is currently no documentation around API rate-limiting, however it is assumed to be customer responsibility. This is something that should be documented as part of customer controls.

• Request a change to existing documentation
• Add new documentation
• Report a technical problem with the documentation
• Other

Tell us about your request. Provide a summary of the request and all versions that are affected.
All existing versions currently do not have this documentation.

What other resources are available? Provide links to related issues, POCs, steps for testing, etc.
Browsed through following searched for term "Rate limit":

• https://opensearch.org/docs/latest
• https://github.com/opensearch-project/OpenSearch/issues
• https://github.com/opensearch-project/security/issue

[cwillum]

Received word about this from the Security team. Looking into it.

[DarshitChanpura]

Hey @cwillum , here is some information that'll help you write this doc.

Here is the code in security plugin that points to rate-limiting: https://github.com/opensearch-project/security/tree/main/src/main/java/org/opensearch/security/auth/limiting

There are two types of rate limiting. Username based and IP based and both of them are configured in config.yml:

1. Username based rate-limiting config:

auth_failure_listeners:
    internal_authentication_backend_limiting:
        type: username
        authentication_backend: intern
        allowed_tries: 3
        time_window_seconds: 60
        block_expiry_seconds: 60
        max_blocked_clients: 100000
        max_tracked_clients: 100000

2. IP based rate limiting config:

auth_failure_listeners:
    ip_rate_limiting:
        type: ip
        allowed_tries: 1
        time_window_seconds: 20
        block_expiry_seconds: 180
        max_blocked_clients: 100000
        max_tracked_clients: 100000

Rate-limiting is disabled by default in OpenSearch, but can be enabled with these settings.