Fine-grained opensearch role access

We’re using role-based access to the self-hosted opensearch, so default anon access from the grafana data source is broken. I don’t want to grant admin rights or cluster-wide RO. Where is the list of required permissions can be found?