[FEATURE] Add IAM authentication option

If people want to connect to an Amazon OpenSearch Service cluster, they have to figure out how to use this client alongside some third-party signing library and/or the AWS SDK, which is non-trivial due to how we (by design) conceal the underlying HTTP requests that the client makes. We should offer IAM signing as an option, just like the OpenSearch CLI does.

Is your feature request related to a problem?

If you want to use this client with an Amazon OpenSearch Service cluster that has IAM authentication rather than basic authentication, it’s a challenge. The best solution is to use the requests_aws4auth library.

What solution would you like?

Something like how requests_aws4auth works:

awsauth = AWS4Auth(credentials.access_key, credentials.secret_key, region, service, session_token=credentials.token)

search = OpenSearch(
    hosts = [{'host': host, 'port': 443}],
    http_auth = awsauth,
    use_ssl = True,
    verify_certs = True,
    connection_class = RequestsHttpConnection
)

What alternatives have you considered?

Maintaining the status quo, which is admittedly the best of all the clients, but still suboptimal.

Do you have any additional context?

https://github.com/opensearch-project/OpenSearch/issues/1400

[lizsnyder]

Perfect, thanks @Shivamdhar. I’ll add a similar sample to the AWS docs.

[GuanLinZhang]

Link has been updated to https://github.com/opensearch-project/opensearch-py/blob/main/USER_GUIDE.md#using-iam-credentials-for-authentication