# Why does it need cluster:monitor/main permission
**URL:** https://discuss.elastic.co/t/why-does-it-need-cluster-monitor-main-permission/310069
**Category:** Elasticsearch
**Tags:** language-clients
**Created:** [July 19, 2022, 9:14pm UTC](https://discuss.elastic.co/t/why-does-it-need-cluster-monitor-main-permission/310069 "2022-07-19T21:14:38Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@xliu](https://discuss.elastic.co/u/xliu)
#### Post date: [July 19, 2022, 9:14pm UTC](https://discuss.elastic.co/t/why-does-it-need-cluster-monitor-main-permission/310069/1 "2022-07-19T21:14:38Z")
ES 7.17 cloud is hosted in [https://xxx.elastic-cloud.com:9243](https://xxx.elastic-cloud.com:9243)
Using Java High Level REST client, I was able to connect to server ES client 7.9.3. Now I update to ES client 7.17.4. But it gives me permission issue.
```
"root_cause":[{"type":"security_exception","reason":"action [cluster:monitor/main] is unauthorized for user [xxxx] with roles
```
Why does it need this permission? Someone mentioned that client pings the cluster using the `/` endpoint and it's actually why the [`cluster:monitor/main` privilege] is required. And this was added after the 7.10.2 Opensearch fork.
Where can I find the reference?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 19, 2022, 9:14pm UTC](https://discuss.elastic.co/t/why-does-it-need-cluster-monitor-main-permission/310069/2 "2022-07-19T21:14:38Z")
OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance.
(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 16, 2022, 9:14pm UTC](https://discuss.elastic.co/t/why-does-it-need-cluster-monitor-main-permission/310069/3 "2022-08-16T21:14:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.