AWS opensearch-service documentation change
Summary
Corrected ARN placeholder syntax (removed curly braces), updated documentation links to use relative paths, fixed example regions (e.g., us-west-2 to us-east-1), and adjusted IAM policy examples. Consolidated IAM role permission references to a security overview guide.
Security assessment
The change updates IAM role permission references to point to 'Setting up roles and users in Amazon OpenSearch Ingestion', which likely consolidates security-related guidance. While ARN syntax corrections prevent potential misconfigurations, there is no explicit evidence of a resolved security vulnerability. The documentation link change adds security-focused content by directing users to a security setup guide.
Diff
diff --git a/opensearch-service/latest/developerguide/configure-client-confluent-kafka.md b/opensearch-service/latest/developerguide/configure-client-confluent-kafka.md index 553605bbc..5489989d7 100644 --- a/opensearch-service/latest/developerguide/configure-client-confluent-kafka.md +++ b/opensearch-service/latest/developerguide/configure-client-confluent-kafka.md @@ -21 +21 @@ Before you create your OpenSearch Ingestion pipeline, perform the following step - 2. Create an OpenSearch Service domain or OpenSearch Serverless collection where you want to migrate data to. For more information, see [Creating OpenSearch Service domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createupdatedomains.html#createdomains) and [Creating collections](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-manage.html#serverless-create). + 2. Create an OpenSearch Service domain or OpenSearch Serverless collection where you want to migrate data to. For more information, see [ Creating OpenSearch Service domains](./createupdatedomains.html#createdomains) and [Creating collections](./serverless-manage.html#serverless-create). @@ -35 +35 @@ The following sample domain access policy allows the pipeline role, which you cr - "AWS": "arn:aws:iam::{pipeline-account-id}:role/pipeline-role" + "AWS": "arn:aws:iam::pipeline-account-id:role/pipeline-role" @@ -42 +42 @@ The following sample domain access policy allows the pipeline role, which you cr - "arn:aws:es:{region}:{account-id}:domain/d{omain-name}" + "arn:aws:es:region:account-id:domain/domain-name" @@ -48 +48 @@ The following sample domain access policy allows the pipeline role, which you cr -To create an IAM role with the correct permissions to access write data to the collection or domain, see [Required permissions for domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/osis-get-started.html#osis-get-started-permissions) and [Required permissions for collections](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/osis-serverless-get-started.html#osis-serverless-get-started-permissions). +To create an IAM role with the correct permissions to access write data to the collection or domain, see [Setting up roles and users in Amazon OpenSearch Ingestion](./pipeline-security-overview.html). @@ -75,3 +75,3 @@ The following permission is needed to manage the network interface: - "arn:aws:ec2:*:{account-id}:network-interface/*", - "arn:aws:ec2:*:{account-id}:subnet/*", - "arn:aws:ec2:*:{account-id}:security-group/*" + "arn:aws:ec2:*:account-id:network-interface/*", + "arn:aws:ec2:*:account-id:subnet/*", + "arn:aws:ec2:*:account-id:security-group/*" @@ -113 +113 @@ The following is permission needed to read secrets from AWS Secrets Manager serv - "Resource": ["arn:aws:secretsmanager:{region}:{account-id}:secret:,{secret-name}"] + "Resource": ["arn:aws:secretsmanager:region:account-id:secret:,secret-name"] @@ -126 +126 @@ The following permissions are needed to write to an Amazon OpenSearch Service do - "AWS": "arn:aws:iam::{your-account-id}:role/{pipeline-role}" + "AWS": "arn:aws:iam::account-id:role/pipeline-role" @@ -129 +129 @@ The following permissions are needed to write to an Amazon OpenSearch Service do - "Resource": "arn:aws:es:{region}:{your-account-id}:domain/{domain-name}/*" + "Resource": "arn:aws:es:region:account-id:domain/domain-name/*" @@ -153 +153 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - - "bootstrap-server.us-west-2.aws.private.confluent.cloud:9092" + - "bootstrap-server.us-east-1.aws.private.confluent.cloud:9092" @@ -161 +161 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - registry_url: https://my-registry.us-west-2.aws.confluent.cloud + registry_url: https://my-registry.us-east-1.aws.confluent.cloud @@ -167 +167 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - hosts: ["https://search-mydomain.us-west-2.es.amazonaws.com"] + hosts: ["https://search-mydomain.us-east-1.es.amazonaws.com"] @@ -169,2 +169,2 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - sts_role_arn: "arn:aws:iam::{account-id}:role/pipeline-role" - region: "us-west-2" + sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" + region: "us-east-1" @@ -177,2 +177,2 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - region: "us-west-2" - sts_role_arn: "arn:aws:iam::{account-id}:role/pipeline-role" + region: "us-east-1" + sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" @@ -181,2 +181,2 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - region: "us-west-2" - sts_role_arn: "arn:aws:iam::{account-id}:role/pipeline-role" + region: "us-east-1" + sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" @@ -209 +209 @@ Before you create your OpenSearch Ingestion pipeline, perform the following step - 2. Create an OpenSearch Service domain or OpenSearch Serverless collection where you want to migrate data to. For more information, see [Creating OpenSearch Service domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createupdatedomains.html#createdomains) and [Creating collections](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-manage.html#serverless-create). + 2. Create an OpenSearch Service domain or OpenSearch Serverless collection where you want to migrate data to. For more information, see For more information, see [ Creating OpenSearch Service domains](./createupdatedomains.html#createdomains) and [Creating collections](./serverless-manage.html#serverless-create). @@ -235 +235 @@ The following sample domain access policy allows the pipeline role, which you cr - "AWS": "arn:aws:iam::{pipeline-account-id}:role/{pipeline-role}" + "AWS": "arn:aws:iam::pipeline-account-id:role/pipeline-role" @@ -242 +242 @@ The following sample domain access policy allows the pipeline role, which you cr - "arn:aws:es:{region}:{account-id}:domain/{domain-name}" + "arn:aws:es:region:account-id:domain/domain-name" @@ -248 +248 @@ The following sample domain access policy allows the pipeline role, which you cr -To create an IAM role with the correct permissions to access write data to the collection or domain, see [Required permissions for domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/osis-get-started.html#osis-get-started-permissions) and [Required permissions for collections](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/osis-serverless-get-started.html#osis-serverless-get-started-permissions). +To create an IAM role with the correct permissions to access write data to the collection or domain, see [Setting up roles and users in Amazon OpenSearch Ingestion](./pipeline-security-overview.html). @@ -267 +267 @@ After you have your pipeline prerequisites set up, [configure the pipeline role] - "Resource": ["arn:aws:secretsmanager:{region}:{account-id}:secret:{secret-name}"] + "Resource": ["arn:aws:secretsmanager:region:account-id:secret:secret-name"] @@ -281,3 +281,3 @@ After you have your pipeline prerequisites set up, [configure the pipeline role] - "arn:aws:ec2:*:{account-id}:network-interface/*", - "arn:aws:ec2:*:{account-id}:subnet/*", - "arn:aws:ec2:*:{account-id}:security-group/*" + "arn:aws:ec2:*:account-id:network-interface/*", + "arn:aws:ec2:*:account-id:subnet/*", + "arn:aws:ec2:*:account-id:security-group/*" @@ -335 +335 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - - "bootstrap-server.us-west-2.aws.private.confluent.cloud:9092" + - "bootstrap-server.us-east-1.aws.private.confluent.cloud:9092" @@ -343 +343 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - registry_url: https://my-registry.us-west-2.aws.confluent.cloud + registry_url: https://my-registry.us-east-1.aws.confluent.cloud @@ -349 +349 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - hosts: ["https://search-mydomain.us-west-2.es.amazonaws.com"] + hosts: ["https://search-mydomain.us-east-1.es.amazonaws.com"] @@ -351,2 +351,2 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - sts_role_arn: "arn:aws:iam::{account-id}:role/pipeline-role" - region: "us-west-2" + sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" + region: "us-east-1" @@ -359,2 +359,2 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - region: "us-west-2" - sts_role_arn: "arn:aws:iam::{account-id}:role/pipeline-role" + region: "us-east-1" + sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" @@ -363,2 +363,2 @@ You can also migrate data from a source Confluent Kafka cluster to an OpenSearch - region: "us-west-2" - sts_role_arn: "arn:aws:iam::{account-id}:role/pipeline-role" + region: "us-east-2" + sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role"