[Backport 2.x] FIX: extract reason from error in AWSSdk2Transport

CHANGELOG.md

@@ -105,6 +105,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - Fix AwsSdk2TransportOptions.responseCompression ([#322](https://github.com/opensearch-project/opensearch-java/pull/322))
 - Fix missing Highlight and SourceConfig in the MultisearchBody ([#442](https://github.com/opensearch-project/opensearch-java/pull/442))
 - Fix parsing /_alias error response for not existing alias ([#476](https://github.com/opensearch-project/opensearch-java/pull/476))
+- Fix missing cause message in missing permission to call Fine Grained Access Control Amazon OpenSearch domain ([#473](https://github.com/opensearch-project/opensearch-java/issues/473))
 - Fix catching JsonParsingException ([#494](https://github.com/opensearch-project/opensearch-java/issues/494))
 - Fix StoryStats numeric value out of range of int ([#489](https://github.com/opensearch-project/opensearch-java/pull/489))
 

java-client/src/main/java/org/opensearch/client/transport/aws/AwsSdk2Transport.java

@@ -457,7 +457,13 @@ private <ResponseT, ErrorT> ResponseT parseResponse(
                     JsonObject val = JsonpDeserializer.jsonValueDeserializer()
                             .deserialize(parser, mapper)
                             .asJsonObject();
-                    String message = val.getString("Message", null);
+                    String message = null;
+                    if (val.get("error") instanceof JsonObject) {
+                        message = val.get("error").asJsonObject().getString("reason", null);
+                    }
+                    if (message == null) {
+                        message = val.getString("Message", null);
+                    }
                     if (message == null) {
                         message = val.getString("message", null);
                     }

java-client/src/test/java/org/opensearch/client/opensearch/integTest/aws/AwsSdk2SecurityIT.java

@@ -0,0 +1,31 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.client.opensearch.integTest.aws;
+
+import org.junit.Test;
+import org.opensearch.client.opensearch.OpenSearchClient;
+import org.opensearch.client.opensearch._types.OpenSearchException;
+import org.opensearch.client.opensearch.cluster.GetClusterSettingsRequest;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertThrows;
+
+public class AwsSdk2SecurityIT extends AwsSdk2TransportTestCase {
+    private static final String DEFAULT_MESSAGE = "authentication/authorization failure";
+    @Test
+    public void testUnAuthorizedException() {
+        final OpenSearchClient client = getClient(false, null, null);
+        final GetClusterSettingsRequest request = new GetClusterSettingsRequest.Builder()
+                .includeDefaults(true)
+                .build();
+        final OpenSearchException ex = assertThrows(
+                OpenSearchException.class, () -> client.cluster().getSettings(request));
+        assertFalse(ex.getMessage().contains(DEFAULT_MESSAGE));
+    }
+}