AWS opensearch-service documentation change
Summary
Updated ARN format examples by removing curly braces from placeholder values (region, account IDs) and fixed a typo in 'pipeline' spelling
Security assessment
Changes involve documentation formatting corrections and typo fixes. While ARN format accuracy is important for IAM policies, there's no evidence these changes address a specific security vulnerability or weakness.
Diff
diff --git a/opensearch-service/latest/developerguide/configure-client-msk.md b/opensearch-service/latest/developerguide/configure-client-msk.md index e3ee922e3..91719aab0 100644 --- a/opensearch-service/latest/developerguide/configure-client-msk.md +++ b/opensearch-service/latest/developerguide/configure-client-msk.md @@ -52 +52 @@ The following policies applies when your cluster and pipeline are in the same AW - "Resource": "arn:aws:kafka:{region}:{account-id}:cluster/cluster-name/cluster-id" + "Resource": "arn:aws:kafka:region:account-id:cluster/cluster-name/cluster-id" @@ -64 +64 @@ The following policies applies when your cluster and pipeline are in the same AW - "Resource": "arn:aws:kafka:{region}:{account-id}:cluster/cluster-name/cluster-id" + "Resource": "arn:aws:kafka:region:account-id:cluster/cluster-name/cluster-id" @@ -69 +69 @@ The following policies applies when your cluster and pipeline are in the same AW -If your Amazon MSK cluster is in a different AWS account than your pipeline, attach the following policy instead. Note that cross-account access is only possible with provisioned Amazon MSK clusters and not Amazon MSK Serverless clusters. The ARN for the AWS `principal` should be the ARN for the same pipeline role that you provide to your pipleine YAML configuration: +If your Amazon MSK cluster is in a different AWS account than your pipeline, attach the following policy instead. Note that cross-account access is only possible with provisioned Amazon MSK clusters and not Amazon MSK Serverless clusters. The ARN for the AWS `principal` should be the ARN for the same pipeline role that you provide to your pipeline configuration: @@ -83 +83 @@ If your Amazon MSK cluster is in a different AWS account than your pipeline, att - "Resource": "arn:aws:kafka:{region}:{msk-account-id}:cluster/cluster-name/cluster-id" + "Resource": "arn:aws:kafka:region:msk-account-id:cluster/cluster-name/cluster-id" @@ -95 +95 @@ If your Amazon MSK cluster is in a different AWS account than your pipeline, att - "Resource": "arn:aws:kafka:{region}:{msk-account-id}:cluster/cluster-name/cluster-id" + "Resource": "arn:aws:kafka:region:msk-account-id:cluster/cluster-name/cluster-id" @@ -100 +100 @@ If your Amazon MSK cluster is in a different AWS account than your pipeline, att - "AWS": "arn:aws:iam::{pipeline-account-id}:role/pipeline-role" + "AWS": "arn:aws:iam::pipeline-account-id:role/pipeline-role" @@ -107,3 +107,3 @@ If your Amazon MSK cluster is in a different AWS account than your pipeline, att - "arn:aws:kafka:us-east-1:{msk-account-id}:cluster/cluster-name/cluster-id", - "arn:aws:kafka:us-east-1:{msk-account-id}:topic/cluster-name/cluster-id/*", - "arn:aws:kafka:us-east-1:{msk-account-id}:group/cluster-name/*" + "arn:aws:kafka:us-east-1:msk-account-id:cluster/cluster-name/cluster-id", + "arn:aws:kafka:us-east-1:msk-account-id:topic/cluster-name/cluster-id/*", + "arn:aws:kafka:us-east-1:msk-account-id:group/cluster-name/*" @@ -142 +142 @@ Before you create your OpenSearch Ingestion pipeline, perform the following step - "Resource": "arn:aws:kafka:{region}:{account-id}:cluster/cluster-name/cluster-id" + "Resource": "arn:aws:kafka:region:account-id:cluster/cluster-name/cluster-id" @@ -154 +154 @@ Before you create your OpenSearch Ingestion pipeline, perform the following step - "Resource": "arn:aws:kafka:{region}:{account-id}:cluster/cluster-name/cluster-id" + "Resource": "arn:aws:kafka:region:account-id:cluster/cluster-name/cluster-id" @@ -186 +186 @@ After you have your Amazon MSK provisoned or serverless cluster set up, add the - "arn:aws:kafka:{region}:{account-id}:cluster/cluster-name/cluster-id" + "arn:aws:kafka:region:account-id:cluster/cluster-name/cluster-id" @@ -196 +196 @@ After you have your Amazon MSK provisoned or serverless cluster set up, add the - "arn:aws:kafka:{region}:{account-id}:topic/cluster-name/cluster-id/topic-name" + "arn:aws:kafka:region:account-id:topic/cluster-name/cluster-id/topic-name" @@ -206 +206 @@ After you have your Amazon MSK provisoned or serverless cluster set up, add the - "arn:aws:kafka:{region}:{account-id}:group/cluster-name/*" + "arn:aws:kafka:region:account-id:group/cluster-name/*" @@ -227 +227 @@ You can then configure an OpenSearch Ingestion pipeline like the following, whic - arn: "arn:aws:kafka:{region}:{account-id}:cluster/cluster-name/cluster-id" + arn: "arn:aws:kafka:region:account-id:cluster/cluster-name/cluster-id" @@ -229 +229 @@ You can then configure an OpenSearch Ingestion pipeline like the following, whic - sts_role_arn: "arn:aws:iam::{account-id}:role/pipeline-role" + sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" @@ -242,2 +242,2 @@ You can then configure an OpenSearch Ingestion pipeline like the following, whic - aws_sts_role_arn: "arn:aws:iam::{account-id}:role/pipeline-role" - aws_region: "{region}" + aws_sts_role_arn: "arn:aws:iam::account-id:role/pipeline-role" + aws_region: "region"