If you are using an API key with “Restrict privileges”, be sure to review the Indices privileges to provide at least "auto_configure" & "write" permissions for the indices you will be using with this delivery stream.
We should make sure to add in the documentation about permissions are required for logs-awsfirehose-default and metrics-aws.cloudwatch-default data streams since they are the default destination for logs and metrics.
Right now in our documentation, we stated:
We should make sure to add in the documentation about permissions are required for
logs-awsfirehose-defaultandmetrics-aws.cloudwatch-defaultdata streams since they are the default destination for logs and metrics.